CVE-2026-125227 · Package
NO FIX YET · SEE WHAT TO DO
FFmpeg's JPEG bitstream writer miscalculates buffer sizes for scans of 512 MiB or more on 32-bit builds, causing a heap buffer overflow. An attacker who supplies a crafted MJPEG or JPEG stream can corrupt the heap or crash the application.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Exposure requires a 32-bit FFmpeg build that processes attacker-supplied MJPEG or JPEG streams through CBS bitstream filters such as filter_units. Services that only decode trusted local media or run on 64-bit builds are less exposed. The sources do not state a fixed version number.
Not affected if 64-bit-build, no-cbs-filters, no-untrusted-jpeg-input
Who cares 32-bit, ffmpeg, libavcodec, media-processing
ffmpeg -version showing a 32-bit configuration.FFmpeg through 9.0.2 contains an integer overflow in cbs_jpeg_write_scan() in libavcodec/cbs_jpeg.c that causes a heap buffer overflow on 32-bit builds. Attackers can supply a crafted MJPEG/JPEG stream with a scan of 512 MiB or more, processed by CBS bitstream filters like filter_units, to corrupt the heap or crash the application.
This page as .md · .json · CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.