{"id":"CVE-2026-125213","kind":"vulnerability","aliases":["CVE-2026-125213"],"related":[],"title":"FFmpeg: crafted PSD image overflows heap on 32-bit builds","description":"FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in the PSD decoder in libavcodec/psd.c that allows attackers to corrupt heap memory on 32-bit builds by supplying a crafted PSD image. Attackers can choose dimensions and channel counts whose product exceeds 4 GB, truncating the av_malloc allocation size so decode_rle() writes attacker-controlled data past the buffer, causing crashes or possible code execution.","summary":"A crafted PSD image with huge dimensions and channel counts makes FFmpeg's PSD decoder truncate an allocation size and write past a heap buffer. An attacker can crash FFmpeg or possibly run code when it processes the file.","severity":"high","cvss":7.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ffmpeg","fixed":[],"affected":"<= 9.0.2 (32-bit builds)","ecosystem":"vendor"}],"ecosystems":[],"tags":["32-bit","ffmpeg","libavcodec","media-processing","runtime"],"not_affected_if":["64-bit","64-bit-build","no-psd-input"],"how_to_check":"Run ffmpeg -version; versions up to and including 9.0.2 are listed as affected. Then check whether the build is 32-bit (file $(which ffmpeg), or uname -m on the host). Only 32-bit builds were shown to overflow. Also check any app that bundles libavcodec and decodes untrusted PSD files.","fix":"No release named in the sources. Upstream commit aa4b80b54ee8645b5a77fe835ab2bbae1c9c465c (libavcodec/psd.c) rejects uncompressed image sizes above INT_MAX; build from a tree containing it or take a distro package that backports it.","status":"open","published_at":"2026-11-09T19:16:58+00:00","first_seen_at":"2026-11-09T19:28:19+00:00","triaged_at":"2026-11-09T19:30:05+00:00","updated_at":"2026-11-09T19:33:50+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-09T19:30:05Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"FFmpeg: crafted PSD image overflows heap on 32-bit builds","impact":"high","summary":"A crafted PSD image with huge dimensions and channel counts makes FFmpeg's PSD decoder truncate an allocation size and write past a heap buffer. An attacker can crash FFmpeg or possibly run code when it processes the file.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["ffmpeg","libavcodec","32-bit","media-processing"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker corrupts heap memory and may run code.","analyst_note":"Confirm the fixed FFmpeg version and whether 64-bit builds are unaffected, using the Patch and VulnCheck links.","how_to_check":"- Run `ffmpeg -version` and compare the version with the fixed release in the sources; the sources do not name one.\n- Check whether the FFmpeg build is 32-bit, since the sources say the flaw affects 32-bit builds.\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["64-bit-build","no-psd-input"],"who_is_affected":"The flaw is in the PSD decoder of libavcodec on 32-bit builds of FFmpeg through 9.0.2, so systems that decode untrusted PSD files are the ones to look at. Systems on 64-bit builds or that never process PSD images are less exposed; the sources do not say more.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000754,"input_tokens":4662,"output_tokens":575,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed FFmpeg version and whether 64-bit builds are unaffected, using the Patch and VulnCheck links.","search":"'-125213':13A,16A '-2026':12A,15A '32':8A,18B,88C '4':107C '9.0.2':67C 'alloc':43B,113C 'allow':81C 'attack':52B,82C,97C,120C 'attacker-control':119C 'av':111C 'bit':9A,19B,89C 'buffer':50B,71C,125C 'build':10A,90C 'caus':126C 'channel':34B,102C 'choos':99C 'code':59B,130C 'contain':68C 'control':121C 'corrupt':84C 'count':35B,103C 'craft':2A,27B,94C 'crash':54B,127C 'cve':11A,14A 'data':122C 'decod':40B,77C,116C 'dimens':32B,100C 'exceed':106C 'execut':131C 'ffmpeg':1A,17A,20B,37B,55B,65C 'file':64B 'gb':108C 'heap':6A,49B,70C,85C 'huge':31B 'imag':4A,29B,96C 'libavcodec':21B 'libavcodec/psd.c':79C 'make':36B 'malloc':112C 'media':23B 'media-process':22B 'memori':86C 'overflow':5A,72C 'past':47B,123C 'possibl':57B,129C 'process':24B,62B 'product':105C 'psd':3A,28B,39B,76C,95C 'rle':117C 'run':58B 'runtim':25B 'size':44B,114C 'suppli':92C 'truncat':41B,109C 'vulner':73C 'whose':104C 'write':46B,118C","nicknames":[],"mitigations":[],"who_affected":"32-bit builds of FFmpeg up to 9.0.2 (libavcodec PSD decoder) that decode untrusted PSD images, such as upload-processing, thumbnailing or transcoding pipelines. A crafted file with huge dimensions and channel counts truncates an allocation size and causes an out-of-bounds heap write, a crash or possibly code execution. 64-bit builds were not reported as affected, and systems that never decode PSD input can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":["ffmpeg"],"ptokens":["ffmpeg"],"labels":["32bit","ffmpeg","high","libavcodec","mediaprocessing","runtime"],"campaign_type":null,"search_a":"'-125213':13A,16A '-2026':12A,15A '32':8A 'bit':9A 'build':10A 'craft':2A 'cve':11A,14A 'ffmpeg':1A,17A 'heap':6A 'imag':4A 'overflow':5A 'psd':3A","search_b":"'32':18B 'alloc':43B 'attack':52B 'bit':19B 'buffer':50B 'channel':34B 'code':59B 'count':35B 'craft':27B 'crash':54B 'decod':40B 'dimens':32B 'ffmpeg':20B,37B,55B 'file':64B 'heap':49B 'huge':31B 'imag':29B 'libavcodec':21B 'make':36B 'media':23B 'media-process':22B 'past':47B 'possibl':57B 'process':24B,62B 'psd':28B,39B 'run':58B 'runtim':25B 'size':44B 'truncat':41B 'write':46B","search_c":"'32':88C '4':107C '9.0.2':67C 'alloc':113C 'allow':81C 'attack':82C,97C,120C 'attacker-control':119C 'av':111C 'bit':89C 'buffer':71C,125C 'build':90C 'caus':126C 'channel':102C 'choos':99C 'code':130C 'contain':68C 'control':121C 'corrupt':84C 'count':103C 'craft':94C 'crash':127C 'data':122C 'decod':77C,116C 'dimens':100C 'exceed':106C 'execut':131C 'ffmpeg':65C 'gb':108C 'heap':70C,85C 'imag':96C 'libavcodec/psd.c':79C 'malloc':112C 'memori':86C 'overflow':72C 'past':123C 'possibl':129C 'product':105C 'psd':76C,95C 'rle':117C 'size':114C 'suppli':92C 'truncat':109C 'vulner':73C 'whose':104C 'write':118C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T19:16:58+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125213","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125213","severity":null,"published_at":"2026-11-09T19:16:58+00:00","modified_at":"2026-11-09T19:16:58+00:00","first_seen_at":"2026-11-09T19:28:19+00:00","fetched_at":"2026-11-09T19:28:19+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-125213:2328","url":null,"severity":null,"published_at":"2026-11-09T19:33:50+00:00","modified_at":"2026-11-09T19:33:50+00:00","first_seen_at":"2026-11-09T19:33:50+00:00","fetched_at":"2026-11-09T19:33:50+00:00","note":"Read VulnCheck advisory and the maintainer commit aa4b80b (psd.c: reject uncompressed size above INT_MAX). No fixed release named in either; affected 'through 9.0.2' per VulnCheck. 32-bit only (ASAN repro on 32-bit). No exploitation or PoC stated. web-cli out of Exa credits; used WebFetch. Nothing marked verified."}],"documents":[{"id":109316,"url":"https://github.com/FFmpeg/FFmpeg/commit/aa4b80b54ee8645b5a77fe835ab2bbae1c9c465c","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109317,"url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-heap-buffer-overflow-via-psd-decoder-rle-path","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}