{"id":"CVE-2026-125228","kind":"vulnerability","aliases":["CVE-2026-125228"],"related":[],"title":"FFmpeg: NaN audio samples cause out-of-bounds heap read in Vorbis encoder","description":"FFmpeg before 8.1.3 and 9.x before 9.0.2 contains an out-of-bounds read vulnerability in put_vector() in libavcodec/vorbisenc.c when NaN samples leave the codebook entry at -1. Attackers can supply audio with NaN float samples to the native Vorbis encoder, causing heap reads before arrays that crash the application or leak adjacent heap memory into output.","summary":"FFmpeg's native Vorbis encoder reads memory before an array when audio contains NaN float samples, because a codebook entry is left at -1. An attacker who supplies such audio can crash the application or leak adjacent heap memory into the output.","severity":"medium","cvss":5.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ffmpeg","media-processing","package","self-hosted"],"not_affected_if":["no-vorbis-encoding","trusted-input-only"],"how_to_check":"- Check the FFmpeg version with `ffmpeg -version`; versions before `8.1.3` on the 8.x line, or before `9.0.2` on the 9.x line, are in the affected range.\n- Find whether the encoder is used: look for the native Vorbis encoder (`libvorbis` is not this one; the native `vorbis` encoder in libavcodec) in your transcoding pipelines.","fix":"- FFmpeg 8.x: upgrade to `8.1.3` or later.\n- FFmpeg 9.x: upgrade to `9.0.2` or later.","status":"open","published_at":"2026-11-09T19:17:00+00:00","first_seen_at":"2026-11-09T19:28:19+00:00","triaged_at":"2026-11-09T19:31:57+00:00","updated_at":"2026-11-09T19:31:57+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-09T19:31:57Z","model":"claude-haiku-5-5","output":{"fix":"- FFmpeg 8.x: upgrade to `8.1.3` or later.\n- FFmpeg 9.x: upgrade to `9.0.2` or later.","reach":"unknown","title":"FFmpeg: NaN audio samples cause out-of-bounds heap read in Vorbis encoder","impact":"medium","summary":"FFmpeg's native Vorbis encoder reads memory before an array when audio contains NaN float samples, because a codebook entry is left at -1. An attacker who supplies such audio can crash the application or leak adjacent heap memory into the output.","audience":"businesses","category":"package","nicknames":[],"who_cares":["ffmpeg","media-processing","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Attacker crashes the process or leaks heap memory into encoded output","analyst_note":"Confirm whether the libvorbis wrapper is affected and check the Vorbis encoder's default usage; sources are NVD and linked advisories only.","how_to_check":"- Check the FFmpeg version with `ffmpeg -version`; versions before `8.1.3` on the 8.x line, or before `9.0.2` on the 9.x line, are in the affected range.\n- Find whether the encoder is used: look for the native Vorbis encoder (`libvorbis` is not this one; the native `vorbis` encoder in libavcodec) in your transcoding pipelines.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-vorbis-encoding","trusted-input-only"],"who_is_affected":"Systems that run FFmpeg and encode audio to Vorbis with the native encoder, especially those that process audio from untrusted users. Deployments that only decode, or that encode with other codecs, are less exposed. The sources do not say whether the libvorbis wrapper is affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000813,"input_tokens":4640,"output_tokens":698,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-1':52B,100C '-125228':17A,20A '-2026':16A,19A '8.1.3':73C '9':75C '9.0.2':78C 'adjac':65B,125C 'applic':62B,122C 'array':38B,118C 'attack':54B,101C 'audio':3A,40B,58B,104C 'bound':9A,84C 'caus':5A,114C 'codebook':47B,97C 'contain':41B,79C 'crash':60B,120C 'cve':15A,18A 'encod':14A,33B,113C 'entri':48B,98C 'ffmpeg':1A,21B,29B,71C 'float':43B,107C 'heap':10A,66B,115C,126C 'host':28B 'leak':64B,124C 'leav':95C 'left':50B 'libavcodec/vorbisenc.c':91C 'media':23B 'media-process':22B 'memori':35B,67B,127C 'nan':2A,42B,93C,106C 'nativ':31B,111C 'out-of-bound':6A,81C 'output':70B,129C 'packag':25B 'process':24B 'put':88C 'read':11A,34B,85C,116C 'sampl':4A,44B,94C,108C 'self':27B 'self-host':26B 'suppli':56B,103C 'vector':89C 'vorbi':13A,32B,112C 'vulner':86C 'x':76C","nicknames":[],"mitigations":[],"who_affected":"Systems that run FFmpeg and encode audio to Vorbis with the native encoder, especially those that process audio from untrusted users. Deployments that only decode, or that encode with other codecs, are less exposed. The sources do not say whether the libvorbis wrapper is affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ffmpeg","mediaprocessing","medium","package","selfhosted"],"campaign_type":null,"search_a":"'-125228':17A,20A '-2026':16A,19A 'audio':3A 'bound':9A 'caus':5A 'cve':15A,18A 'encod':14A 'ffmpeg':1A 'heap':10A 'nan':2A 'out-of-bound':6A 'read':11A 'sampl':4A 'vorbi':13A","search_b":"'-1':52B 'adjac':65B 'applic':62B 'array':38B 'attack':54B 'audio':40B,58B 'codebook':47B 'contain':41B 'crash':60B 'encod':33B 'entri':48B 'ffmpeg':21B,29B 'float':43B 'heap':66B 'host':28B 'leak':64B 'left':50B 'media':23B 'media-process':22B 'memori':35B,67B 'nan':42B 'nativ':31B 'output':70B 'packag':25B 'process':24B 'read':34B 'sampl':44B 'self':27B 'self-host':26B 'suppli':56B 'vorbi':32B","search_c":"'-1':100C '8.1.3':73C '9':75C '9.0.2':78C 'adjac':125C 'applic':122C 'array':118C 'attack':101C 'audio':104C 'bound':84C 'caus':114C 'codebook':97C 'contain':79C 'crash':120C 'encod':113C 'entri':98C 'ffmpeg':71C 'float':107C 'heap':115C,126C 'leak':124C 'leav':95C 'libavcodec/vorbisenc.c':91C 'memori':127C 'nan':93C,106C 'nativ':111C 'out-of-bound':81C 'output':129C 'put':88C 'read':85C,116C 'sampl':94C,108C 'suppli':103C 'vector':89C 'vorbi':112C 'vulner':86C 'x':76C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T19:17:00+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125228","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125228","severity":null,"published_at":"2026-11-09T19:17:00+00:00","modified_at":"2026-11-09T19:17:00+00:00","first_seen_at":"2026-11-09T19:28:19+00:00","fetched_at":"2026-11-09T19:28:19+00:00","note":null}],"documents":[{"id":109346,"url":"https://github.com/FFmpeg/FFmpeg/commit/e33548ad13fd3495466a651792e8206b1c6f7fd7","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109347,"url":"https://www.vulncheck.com/advisories/ffmpeg-before-8.1.3-and-9-x-before-9.0.2-out-of-bounds-read-in-vorbis-encoder","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}