CVE-2026-125228 · Package
NO FIX YET · SEE WHAT TO DO
FFmpeg's native Vorbis encoder reads memory before an array when audio contains NaN float samples, because a codebook entry is left at -1. An attacker who supplies such audio can crash the application or leak adjacent heap memory into the output.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Systems that run FFmpeg and encode audio to Vorbis with the native encoder, especially those that process audio from untrusted users. Deployments that only decode, or that encode with other codecs, are less exposed. The sources do not say whether the libvorbis wrapper is affected.
Not affected if no-vorbis-encoding, trusted-input-only
Who cares ffmpeg, media-processing, self-hosted
ffmpeg -version; versions before 8.1.3 on the 8.x line, or before 9.0.2 on the 9.x line, are in the affected range.libvorbis is not this one; the native vorbis encoder in libavcodec) in your transcoding pipelines.8.1.3 or later.FFmpeg before 8.1.3 and 9.x before 9.0.2 contains an out-of-bounds read vulnerability in put_vector() in libavcodec/vorbisenc.c when NaN samples leave the codebook entry at -1. Attackers can supply audio with NaN float samples to the native Vorbis encoder, causing heap reads before arrays that crash the application or leak adjacent heap memory into output.
This page as .md · .json · CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
9.0.2