{"id":"CVE-2026-125227","kind":"vulnerability","aliases":["CVE-2026-125227"],"related":[],"title":"FFmpeg: integer overflow in JPEG scan writer enables heap corruption","description":"FFmpeg through 9.0.2 contains an integer overflow in cbs_jpeg_write_scan() in libavcodec/cbs_jpeg.c that causes a heap buffer overflow on 32-bit builds. Attackers can supply a crafted MJPEG/JPEG stream with a scan of 512 MiB or more, processed by CBS bitstream filters like filter_units, to corrupt the heap or crash the application.","summary":"FFmpeg's JPEG bitstream writer miscalculates buffer sizes for scans of 512 MiB or more on 32-bit builds, causing a heap buffer overflow. An attacker who supplies a crafted MJPEG or JPEG stream can corrupt the heap or crash the application.","severity":"high","cvss":7.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["32-bit","ffmpeg","libavcodec","media-processing","package"],"not_affected_if":["64-bit-build","no-cbs-filters","no-untrusted-jpeg-input"],"how_to_check":"- Check whether FFmpeg or libavcodec is built for a 32-bit target, for example with `ffmpeg -version` showing a 32-bit configuration.\n- Check whether the application runs CBS bitstream filters such as filter_units on untrusted JPEG or MJPEG input.","fix":"- FFmpeg: the sources do not state a fixed version; the linked patch is on github.com.","status":"open","published_at":"2026-11-09T19:17:00+00:00","first_seen_at":"2026-11-09T19:28:19+00:00","triaged_at":"2026-11-09T19:29:57+00:00","updated_at":"2026-11-09T19:29:57+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-09T19:29:57Z","model":"claude-haiku-5-5","output":{"fix":"- FFmpeg: the sources do not state a fixed version; the linked patch is on github.com.","reach":"unknown","title":"FFmpeg: integer overflow in JPEG scan writer enables heap corruption","impact":"high","summary":"FFmpeg's JPEG bitstream writer miscalculates buffer sizes for scans of 512 MiB or more on 32-bit builds, causing a heap buffer overflow. An attacker who supplies a crafted MJPEG or JPEG stream can corrupt the heap or crash the application.","audience":"businesses","category":"package","nicknames":[],"who_cares":["ffmpeg","libavcodec","32-bit","media-processing"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Attacker corrupts heap memory or crashes the application processing media","analyst_note":"Confirm the fixed FFmpeg version and exact affected build conditions from the linked GitHub patch and vulncheck advisory.","how_to_check":"- Check whether FFmpeg or libavcodec is built for a 32-bit target, for example with `ffmpeg -version` showing a 32-bit configuration.\n- Check whether the application runs CBS bitstream filters such as filter_units on untrusted JPEG or MJPEG input.\n- unknown for exact affected build flags beyond the description.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["64-bit-build","no-untrusted-jpeg-input","no-cbs-filters"],"who_is_affected":"Exposure requires a 32-bit FFmpeg build that processes attacker-supplied MJPEG or JPEG streams through CBS bitstream filters such as filter_units. Services that only decode trusted local media or run on 64-bit builds are less exposed. The sources do not state a fixed version number.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.0008,"input_tokens":4652,"output_tokens":669,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-125227':13A,16A '-2026':12A,15A '32':17B,41B,88C '512':36B,102C '9.0.2':69C 'applic':66B,121C 'attack':50B,91C 'bit':18B,42B,89C 'bitstream':28B,109C 'buffer':31B,47B,85C 'build':43B,90C 'caus':44B,82C 'cbs':75C,108C 'contain':70C 'corrupt':10A,60B,115C 'craft':54B,95C 'crash':64B,119C 'cve':11A,14A 'enabl':8A 'ffmpeg':1A,19B,25B,67C 'filter':110C,112C 'heap':9A,46B,62B,84C,117C 'integ':2A,72C 'jpeg':5A,27B,57B,76C 'libavcodec':20B 'libavcodec/cbs_jpeg.c':80C 'like':111C 'media':22B 'media-process':21B 'mib':37B,103C 'miscalcul':30B 'mjpeg':55B 'mjpeg/jpeg':96C 'overflow':3A,48B,73C,86C 'packag':24B 'process':23B,106C 'scan':6A,34B,78C,100C 'size':32B 'stream':58B,97C 'suppli':52B,93C 'unit':113C 'write':77C 'writer':7A,29B","nicknames":[],"mitigations":[],"who_affected":"Exposure requires a 32-bit FFmpeg build that processes attacker-supplied MJPEG or JPEG streams through CBS bitstream filters such as filter_units. Services that only decode trusted local media or run on 64-bit builds are less exposed. The sources do not state a fixed version number.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["32bit","ffmpeg","high","libavcodec","mediaprocessing","package"],"campaign_type":null,"search_a":"'-125227':13A,16A '-2026':12A,15A 'corrupt':10A 'cve':11A,14A 'enabl':8A 'ffmpeg':1A 'heap':9A 'integ':2A 'jpeg':5A 'overflow':3A 'scan':6A 'writer':7A","search_b":"'32':17B,41B '512':36B 'applic':66B 'attack':50B 'bit':18B,42B 'bitstream':28B 'buffer':31B,47B 'build':43B 'caus':44B 'corrupt':60B 'craft':54B 'crash':64B 'ffmpeg':19B,25B 'heap':46B,62B 'jpeg':27B,57B 'libavcodec':20B 'media':22B 'media-process':21B 'mib':37B 'miscalcul':30B 'mjpeg':55B 'overflow':48B 'packag':24B 'process':23B 'scan':34B 'size':32B 'stream':58B 'suppli':52B 'writer':29B","search_c":"'32':88C '512':102C '9.0.2':69C 'applic':121C 'attack':91C 'bit':89C 'bitstream':109C 'buffer':85C 'build':90C 'caus':82C 'cbs':75C,108C 'contain':70C 'corrupt':115C 'craft':95C 'crash':119C 'ffmpeg':67C 'filter':110C,112C 'heap':84C,117C 'integ':72C 'jpeg':76C 'libavcodec/cbs_jpeg.c':80C 'like':111C 'mib':103C 'mjpeg/jpeg':96C 'overflow':73C,86C 'process':106C 'scan':78C,100C 'stream':97C 'suppli':93C 'unit':113C 'write':77C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T19:17:00+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125227","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125227","severity":null,"published_at":"2026-11-09T19:17:00+00:00","modified_at":"2026-11-09T19:17:00+00:00","first_seen_at":"2026-11-09T19:28:19+00:00","fetched_at":"2026-11-09T19:28:19+00:00","note":null}],"documents":[{"id":109344,"url":"https://github.com/FFmpeg/FFmpeg/commit/b89ce54d93bf644433dfa9fbc34f19c22237691a","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109345,"url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-heap-buffer-overflow-via-cbs-jpeg-write-scan-integer-overflow","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}