{"id":"CVE-2026-125235","kind":"vulnerability","aliases":["CVE-2026-125235"],"related":[],"title":"FFmpeg: heap overflow in Quick Sync encoder lets crafted video corrupt memory","description":"FFmpeg through 9.0.2 contains a heap overflow vulnerability in libavcodec/qsvenc.c that allows attackers to corrupt memory by reusing an undersized pooled QSVFrame buffer when input dimensions increase. Attackers can supply crafted input whose resolution grows mid-stream, transcoded with Intel Quick Sync encoders without rescaling, to crash the application or corrupt heap memory.","summary":"FFmpeg's Intel Quick Sync encoder in libavcodec/qsvenc.c reuses an undersized pooled frame buffer when input resolution grows mid-stream. An attacker who supplies a crafted video whose resolution increases can crash the application or corrupt heap memory.","severity":"high","cvss":7.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ffmpeg","fixed":[],"affected":"<= 9.0.2 (QSV encoders)","ecosystem":"vendor"}],"ecosystems":[],"tags":["ffmpeg","intel-quick-sync","media-transcoding","package"],"not_affected_if":["no-qsv-encoder","trusted-input-only"],"how_to_check":"- Run ffmpeg -version; builds of 9.0.2 and earlier are listed as affected (VulnCheck, third party).\n- Run ffmpeg -encoders | grep qsv; if no *_qsv encoder is listed, the reported QSV path is not in your build.\n- Check whether your build contains commit 9b99973b2bbecee0b7e1e57035b95498b42f54a6, or ask your distro whether it backported it.\n- Also check any pipeline that feeds untrusted video whose resolution can grow mid-stream into a hardware encoder (VideoToolbox), since the commit message mentions it.","fix":"No fixed release is named in the sources. Upstream patch is commit 9b99973b2bbecee0b7e1e57035b95498b42f54a6 (libavcodec/encode.c), which rejects any video frame whose size differs from the encoder's. Build from a tree that contains it, or wait for a release or distro package that lists it. Fixed version: unknown; the FFmpeg release notes or tags would settle it.","status":"open","published_at":"2026-11-09T19:17:01+00:00","first_seen_at":"2026-11-09T19:28:20+00:00","triaged_at":"2026-11-09T19:29:55+00:00","updated_at":"2026-11-09T19:32:39+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-09T19:29:55Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"FFmpeg: heap overflow in Quick Sync encoder lets crafted video corrupt memory","impact":"high","summary":"FFmpeg's Intel Quick Sync encoder in libavcodec/qsvenc.c reuses an undersized pooled frame buffer when input resolution grows mid-stream. An attacker who supplies a crafted video whose resolution increases can crash the application or corrupt heap memory.","audience":"businesses","category":"package","nicknames":[],"who_cares":["ffmpeg","intel-quick-sync","media-transcoding"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker corrupts heap memory or crashes the transcoding process","analyst_note":"Confirm the fixed FFmpeg version and whether the upstream patch (linked as fix) names it; sources do not state a fixed version.","how_to_check":"- Check whether FFmpeg is built with Intel Quick Sync (QSV) encoders, for example with `ffmpeg -encoders | grep qsv`\n- Check the installed FFmpeg version with `ffmpeg -version`; the sources say versions through `9.0.2` are affected\n- unknown whether a specific fixed version is listed in the sources","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-qsv-encoder","trusted-input-only"],"who_is_affected":"Systems that run FFmpeg to transcode untrusted video with Intel Quick Sync encoders, where input resolution can change mid-stream and no rescaling is applied. Deployments that only process trusted media, use other encoders, or do not have Quick Sync are less exposed. unknown whether the sources name other specific conditions.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000789,"input_tokens":4647,"output_tokens":649,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed FFmpeg version and whether the upstream patch (linked as fix) names it; sources do not state a fixed version.","search":"'-125235':15A,18A '-2026':14A,17A '9.0.2':70C 'allow':79C 'applic':63B,117C 'attack':51B,80C,95C 'buffer':42B,90C 'contain':71C 'corrupt':11A,65B,82C,119C 'craft':9A,55B,98C 'crash':61B,115C 'cve':13A,16A 'dimens':93C 'encod':7A,34B,111C 'ffmpeg':1A,19A,20B,29B,68C 'frame':41B 'grow':46B,102C 'heap':2A,66B,73C,120C 'increas':59B,94C 'input':44B,92C,99C 'intel':22B,31B,108C 'intel-quick-sync':21B 'let':8A 'libavcodec/qsvenc.c':36B,77C 'media':26B 'media-transcod':25B 'memori':12A,67B,83C,121C 'mid':48B,104C 'mid-stream':47B,103C 'overflow':3A,74C 'packag':28B 'pool':40B,88C 'qsvframe':89C 'quick':5A,23B,32B,109C 'rescal':113C 'resolut':45B,58B,101C 'reus':37B,85C 'stream':49B,105C 'suppli':53B,97C 'sync':6A,24B,33B,110C 'transcod':27B,106C 'unders':39B,87C 'video':10A,56B 'vulner':75C 'whose':57B,100C 'without':112C","nicknames":[],"mitigations":[],"who_affected":"Systems that run FFmpeg to transcode untrusted video with Intel Quick Sync encoders, where input resolution can change mid-stream and no rescaling is applied. Deployments that only process trusted media, use other encoders, or do not have Quick Sync are less exposed. unknown whether the sources name other specific conditions.","tier":"B","verified":{"fix":{"at":"2026-11-09T19:32:39Z","by":"analyst","doc":"https://github.com/FFmpeg/FFmpeg/commit/9b99973b2bbecee0b7e1e57035b95498b42f54a6","run_id":2323}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["ffmpeg"],"ptokens":["ffmpeg"],"labels":["ffmpeg","high","intelquicksync","mediatranscoding","package"],"campaign_type":null,"search_a":"'-125235':15A,18A '-2026':14A,17A 'corrupt':11A 'craft':9A 'cve':13A,16A 'encod':7A 'ffmpeg':1A,19A 'heap':2A 'let':8A 'memori':12A 'overflow':3A 'quick':5A 'sync':6A 'video':10A","search_b":"'applic':63B 'attack':51B 'buffer':42B 'corrupt':65B 'craft':55B 'crash':61B 'encod':34B 'ffmpeg':20B,29B 'frame':41B 'grow':46B 'heap':66B 'increas':59B 'input':44B 'intel':22B,31B 'intel-quick-sync':21B 'libavcodec/qsvenc.c':36B 'media':26B 'media-transcod':25B 'memori':67B 'mid':48B 'mid-stream':47B 'packag':28B 'pool':40B 'quick':23B,32B 'resolut':45B,58B 'reus':37B 'stream':49B 'suppli':53B 'sync':24B,33B 'transcod':27B 'unders':39B 'video':56B 'whose':57B","search_c":"'9.0.2':70C 'allow':79C 'applic':117C 'attack':80C,95C 'buffer':90C 'contain':71C 'corrupt':82C,119C 'craft':98C 'crash':115C 'dimens':93C 'encod':111C 'ffmpeg':68C 'grow':102C 'heap':73C,120C 'increas':94C 'input':92C,99C 'intel':108C 'libavcodec/qsvenc.c':77C 'memori':83C,121C 'mid':104C 'mid-stream':103C 'overflow':74C 'pool':88C 'qsvframe':89C 'quick':109C 'rescal':113C 'resolut':101C 'reus':85C 'stream':105C 'suppli':97C 'sync':110C 'transcod':106C 'unders':87C 'vulner':75C 'whose':100C 'without':112C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T19:17:01+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125235","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125235","severity":null,"published_at":"2026-11-09T19:17:01+00:00","modified_at":"2026-11-09T19:17:01+00:00","first_seen_at":"2026-11-09T19:28:20+00:00","fetched_at":"2026-11-09T19:28:20+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-125235:2323","url":null,"severity":null,"published_at":"2026-11-09T19:32:39+00:00","modified_at":"2026-11-09T19:32:39+00:00","first_seen_at":"2026-11-09T19:32:39+00:00","fetched_at":"2026-11-09T19:32:39+00:00","note":"Upstream fix is commit 9b99973 (libavcodec/encode.c: reject frames whose size differs from the encoder's, not only smaller ones); the page names no release, and the VulnCheck advisory (third party) names none either. Affected through 9.0.2 per VulnCheck only. Commit message says the report covered VideoToolbox and QSV, with software encoders found in triage, so other encoders may be covered by the same patch; I did not confirm that for them. web-cli was out of credits, so I used WebFetch."}],"documents":[{"id":109298,"url":"https://github.com/FFmpeg/FFmpeg/commit/9b99973b2bbecee0b7e1e57035b95498b42f54a6","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109362,"url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-heap-overflow-via-qsv-encoder-submit-frame","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}