---
id: "CVE-2026-125235"
page: "https://infrastack.ai/live/CVE-2026-125235"
kind: "vulnerability"
aliases: ["CVE-2026-125235"]
title: "FFmpeg: heap overflow in Quick Sync encoder lets crafted video corrupt memory"
severity: "high"
cvss: 7.3
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "ffmpeg", "fixed": [], "affected": "<= 9.0.2 (QSV encoders)", "ecosystem": "vendor"}]
ecosystems: []
tags: ["ffmpeg", "intel-quick-sync", "media-transcoding", "package"]
not_affected_if: ["no-qsv-encoder", "trusted-input-only"]
published_at: "2026-11-09T19:17:01+00:00"
first_seen_at: "2026-11-09T19:28:20+00:00"
updated_at: "2026-11-09T19:32:39+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-125235", "first_seen_at": "2026-11-09T19:28:20+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-09T19:32:39+00:00"}]
exploit_sources: []
---

# FFmpeg: heap overflow in Quick Sync encoder lets crafted video corrupt memory

Link for people: https://infrastack.ai/live/CVE-2026-125235 (this .md is for agents)

FFmpeg's Intel Quick Sync encoder in libavcodec/qsvenc.c reuses an undersized pooled frame buffer when input resolution grows mid-stream. An attacker who supplies a crafted video whose resolution increases can crash the application or corrupt heap memory.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:ffmpeg affected <= 9.0.2 (QSV encoders) fixed no fixed version listed

## How to check

- Run ffmpeg -version; builds of 9.0.2 and earlier are listed as affected (VulnCheck, third party).
- Run ffmpeg -encoders | grep qsv; if no *_qsv encoder is listed, the reported QSV path is not in your build.
- Check whether your build contains commit 9b99973b2bbecee0b7e1e57035b95498b42f54a6, or ask your distro whether it backported it.
- Also check any pipeline that feeds untrusted video whose resolution can grow mid-stream into a hardware encoder (VideoToolbox), since the commit message mentions it.

## Fix

No fixed release is named in the sources. Upstream patch is commit 9b99973b2bbecee0b7e1e57035b95498b42f54a6 (libavcodec/encode.c), which rejects any video frame whose size differs from the encoder's. Build from a tree that contains it, or wait for a release or distro package that lists it. Fixed version: unknown; the FFmpeg release notes or tags would settle it.

## Timeline

- 2026-11-09T19:28:20+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-125235
- 2026-11-09T19:32:39+00:00 analyst — Upstream fix is commit 9b99973 (libavcodec/encode.c: reject frames whose size differs from the encoder's, not only smaller ones); the page names no release, and the VulnCheck advisory (third party) names none either. Affected through 9.0.2 per VulnCheck only. Commit message says the report covered VideoToolbox and QSV, with software encoders found in triage, so other encoders may be covered by the same patch; I did not confirm that for them. web-cli was out of credits, so I used WebFetch.

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-heap-overflow-via-qsv-encoder-submit-frame
- [fix] Patch: github.com https://github.com/FFmpeg/FFmpeg/commit/9b99973b2bbecee0b7e1e57035b95498b42f54a6

## From the sources

FFmpeg through 9.0.2 contains a heap overflow vulnerability in libavcodec/qsvenc.c that allows attackers to corrupt memory by reusing an undersized pooled QSVFrame buffer when input dimensions increase. Attackers can supply crafted input whose resolution grows mid-stream, transcoded with Intel Quick Sync encoders without rescaling, to crash the application or corrupt heap memory.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_