CVE-2026-125247 · Runtime
NO FIX YET · SEE WHAT TO DO
FFmpeg through 9.0.2 has an integer overflow in the DNG decoder's dng_decode_tiles() function. A crafted DNG file with TileWidth or TileLength near INT_MAX makes the tile loop skip, so the output frame exposes uninitialized or stale heap memory.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Systems that run FFmpeg to decode DNG images from untrusted sources, such as upload, thumbnailing or media conversion services. A leak needs a crafted file to be processed, and systems that only handle trusted media are less exposed. unknown whether default builds include the DNG decoder.
Not affected if no-dng-decoding, trusted-input-only
Who cares ffmpeg, media-processing, self-hosted
ffmpeg -version; versions through 9.0.2 are listed as affected.9.0.2; the sources reviewed do not name the exact fixed version.FFmpeg through 9.0.2 contains an integer overflow vulnerability in dng_decode_tiles() that allows attackers to leak uninitialized memory via crafted DNG tile dimensions. Attackers can set TileWidth or TileLength near INT_MAX so the tile loop never runs, outputting a frame exposing uninitialized or stale heap memory.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.