FFMPEG · CVE-2026-125218 · Runtime
NO FIX YET · SEE WHAT TO DO
FFmpeg's APNG encoder, in encode_apng() in libavcodec/pngenc.c, writes past a heap buffer when the frame size changes mid-stream. An attacker who supplies crafted media can crash transcoding applications or corrupt heap memory.
first public Nov 9, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications that run FFmpeg to transcode media supplied by users or other untrusted sources are exposed, mainly when they encode APNG output. Systems that only process trusted local media, or that do not use FFmpeg's APNG encoder, are less exposed. The sources do not say which FFmpeg version contains the fix.
Not affected if apng-not-used, no-untrusted-media
Who cares ffmpeg, media-transcoding, self-hosted
ffmpeg -version; 9.0.2 and earlier are affected per VulnCheck.9.0.2 are affectedFFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in the APNG encoder's encode_apng() function in libavcodec/pngenc.c when frame size changes mid-stream. Attackers can supply crafted media whose resolution grows mid-stream, causing APNG_DISPOSE_OP_BACKGROUND memset writes past prev_frame and crashing or corrupting heap memory in transcoding applications.
This page as .md · .json · CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
9.0.2