CVE-2026-125214 · Runtime
NO FIX YET · SEE WHAT TO DO
FFmpeg's Blu-ray LPCM decoder, pcm_bluray_decode_frame() in libavcodec, writes past its audio frame buffer when the payload length is not a multiple of the sample size, on big-endian hosts. An attacker who supplies a crafted M2TS file can overwrite heap memory with attacker-controlled bytes.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Exposure needs FFmpeg's libavcodec decoding untrusted Blu-ray (M2TS) LPCM audio, on a big-endian host. Little-endian hosts are not described as affected. Systems that only process trusted media, or that run on little-endian hardware, can likely skip it.
Not affected if little-endian-host, no-bluray-input, no-untrusted-media
Who cares big-endian, ffmpeg, libavcodec, media-processing
ffmpeg -version and compare against the fixed release in the sources (unknown here).s390x or ppc64 systems) run FFmpeg to decode untrusted Blu-ray or M2TS input.FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in pcm_bluray_decode_frame() in libavcodec/pcm-bluray.c on big-endian hosts. Attackers can supply a crafted Blu-ray (M2TS) LPCM stream whose payload length is not a multiple of the sample size, writing attacker-controlled bytes past the audio frame buffer.
This page as .md · .json · CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.