{"id":"CVE-2026-125214","kind":"vulnerability","aliases":["CVE-2026-125214"],"related":[],"title":"FFmpeg: crafted Blu-ray audio stream overflows heap on big-endian hosts","description":"FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in pcm_bluray_decode_frame() in libavcodec/pcm-bluray.c on big-endian hosts. Attackers can supply a crafted Blu-ray (M2TS) LPCM stream whose payload length is not a multiple of the sample size, writing attacker-controlled bytes past the audio frame buffer.","summary":"FFmpeg's Blu-ray LPCM decoder, pcm_bluray_decode_frame() in libavcodec, writes past its audio frame buffer when the payload length is not a multiple of the sample size, on big-endian hosts. An attacker who supplies a crafted M2TS file can overwrite heap memory with attacker-controlled bytes.","severity":"high","cvss":7.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["big-endian","ffmpeg","libavcodec","media-processing","runtime"],"not_affected_if":["little-endian-host","no-bluray-input","no-untrusted-media"],"how_to_check":"- Run `ffmpeg -version` and compare against the fixed release in the sources (unknown here).\n- Check whether big-endian hosts (for example some `s390x` or `ppc64` systems) run FFmpeg to decode untrusted Blu-ray or M2TS input.","fix":"- FFmpeg: unknown; the sources name a patch on GitHub but do not state a fixed version.","status":"open","published_at":"2026-11-09T19:16:58+00:00","first_seen_at":"2026-11-09T19:28:19+00:00","triaged_at":"2026-11-09T19:30:01+00:00","updated_at":"2026-11-09T19:30:01+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-09T19:30:01Z","model":"claude-haiku-5-5","output":{"fix":"- FFmpeg: unknown; the sources name a patch on GitHub but do not state a fixed version.","reach":"unknown","title":"FFmpeg: crafted Blu-ray audio stream overflows heap on big-endian hosts","impact":"high","summary":"FFmpeg's Blu-ray LPCM decoder, pcm_bluray_decode_frame() in libavcodec, writes past its audio frame buffer when the payload length is not a multiple of the sample size, on big-endian hosts. An attacker who supplies a crafted M2TS file can overwrite heap memory with attacker-controlled bytes.","audience":"developers","category":"runtime","nicknames":[],"who_cares":["ffmpeg","libavcodec","media-processing","big-endian"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"attacker writes heap memory via crafted media file","analyst_note":"Confirm the fixed FFmpeg version from the GitHub patch and the vulncheck advisory, and whether the bug reaches little-endian builds.","how_to_check":"- Run `ffmpeg -version` and compare against the fixed release in the sources (unknown here).\n- Check whether big-endian hosts (for example some `s390x` or `ppc64` systems) run FFmpeg to decode untrusted Blu-ray or M2TS input.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["little-endian-host","no-untrusted-media","no-bluray-input"],"who_is_affected":"Exposure needs FFmpeg's libavcodec decoding untrusted Blu-ray (M2TS) LPCM audio, on a big-endian host. Little-endian hosts are not described as affected. Systems that only process trusted media, or that run on little-endian hardware, can likely skip it.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000797,"input_tokens":4634,"output_tokens":667,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-125214':17A,20A '-2026':16A,19A '9.0.2':85C 'attack':67B,80B,104C,128C 'attacker-control':79B,127C 'audio':6A,46B,133C 'big':12A,22B,63B,101C 'big-endian':11A,21B,62B,100C 'blu':4A,33B,110C 'blu-ray':3A,32B,109C 'bluray':38B,94C 'buffer':48B,89C,135C 'byte':82B,130C 'contain':86C 'control':81B,129C 'craft':2A,71B,108C 'cve':15A,18A 'decod':36B,39B,95C 'endian':13A,23B,64B,102C 'ffmpeg':1A,24B,30B,83C 'file':73B 'frame':40B,47B,96C,134C 'heap':9A,76B,88C 'host':14A,65B,103C 'length':52B,117C 'libavcodec':25B,42B 'libavcodec/pcm-bluray.c':98C 'lpcm':35B,113C 'm2ts':72B,112C 'media':27B 'media-process':26B 'memori':77B 'multipl':56B,121C 'overflow':8A,90C 'overwrit':75B 'past':44B,131C 'payload':51B,116C 'pcm':37B,93C 'process':28B 'ray':5A,34B,111C 'runtim':29B 'sampl':59B,124C 'size':60B,125C 'stream':7A,114C 'suppli':69B,106C 'vulner':91C 'whose':115C 'write':43B,126C","nicknames":[],"mitigations":[],"who_affected":"Exposure needs FFmpeg's libavcodec decoding untrusted Blu-ray (M2TS) LPCM audio, on a big-endian host. Little-endian hosts are not described as affected. Systems that only process trusted media, or that run on little-endian hardware, can likely skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["bigendian","ffmpeg","high","libavcodec","mediaprocessing","runtime"],"campaign_type":null,"search_a":"'-125214':17A,20A '-2026':16A,19A 'audio':6A 'big':12A 'big-endian':11A 'blu':4A 'blu-ray':3A 'craft':2A 'cve':15A,18A 'endian':13A 'ffmpeg':1A 'heap':9A 'host':14A 'overflow':8A 'ray':5A 'stream':7A","search_b":"'attack':67B,80B 'attacker-control':79B 'audio':46B 'big':22B,63B 'big-endian':21B,62B 'blu':33B 'blu-ray':32B 'bluray':38B 'buffer':48B 'byte':82B 'control':81B 'craft':71B 'decod':36B,39B 'endian':23B,64B 'ffmpeg':24B,30B 'file':73B 'frame':40B,47B 'heap':76B 'host':65B 'length':52B 'libavcodec':25B,42B 'lpcm':35B 'm2ts':72B 'media':27B 'media-process':26B 'memori':77B 'multipl':56B 'overwrit':75B 'past':44B 'payload':51B 'pcm':37B 'process':28B 'ray':34B 'runtim':29B 'sampl':59B 'size':60B 'suppli':69B 'write':43B","search_c":"'9.0.2':85C 'attack':104C,128C 'attacker-control':127C 'audio':133C 'big':101C 'big-endian':100C 'blu':110C 'blu-ray':109C 'bluray':94C 'buffer':89C,135C 'byte':130C 'contain':86C 'control':129C 'craft':108C 'decod':95C 'endian':102C 'ffmpeg':83C 'frame':96C,134C 'heap':88C 'host':103C 'length':117C 'libavcodec/pcm-bluray.c':98C 'lpcm':113C 'm2ts':112C 'multipl':121C 'overflow':90C 'past':131C 'payload':116C 'pcm':93C 'ray':111C 'sampl':124C 'size':125C 'stream':114C 'suppli':106C 'vulner':91C 'whose':115C 'write':126C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T19:16:58+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125214","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125214","severity":null,"published_at":"2026-11-09T19:16:58+00:00","modified_at":"2026-11-09T19:16:58+00:00","first_seen_at":"2026-11-09T19:28:19+00:00","fetched_at":"2026-11-09T19:28:19+00:00","note":null}],"documents":[{"id":109318,"url":"https://github.com/FFmpeg/FFmpeg/commit/a61b32df3fd67f76c1c8c7ea51be2a66efb0f945","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109319,"url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-heap-buffer-overflow-in-blu-ray-pcm-decoder","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}