FFMPEG · CVE-2026-125250 · Package
NO FIX YET · SEE WHAT TO DO
FFmpeg's GIF encoder sizes a buffer from the first frame's line length, so a video whose line length grows mid-stream makes it write past the buffer. An attacker who supplies such a file can corrupt memory during GIF transcoding, which can lead to code execution.
first public Nov 9, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Any service that runs FFmpeg to transcode user-supplied video into GIF is exposed, because the attacker's file controls the frame sizes. Systems that only process trusted media, or that never produce GIF output, are less exposed. The sources do not list fixed versions beyond the affected range through 9.0.2.
Not affected if no-gif-output, no-user-uploads
Who cares ffmpeg, media-transcoding, self-hosted
Run ffmpeg -version; versions up to 9.0.2 are affected. Also check whether your build includes commit 26c2980 (git tag --contains 26c2980 in a clone). Only matters if you encode to GIF (-c:v gif or .gif output) from untrusted input. Workaround until patched: do not accept untrusted video for GIF output.
9.0.2 once confirmedFFmpeg through 9.0.2 contains a heap buffer overflow in the GIF encoder's gif_image_write_image() in libavcodec/gif.c because shrunk_buf is sized from the first frame's linesize. Attackers can supply PAL8 video whose frame linesize grows mid-stream, causing remap_frame_to_palette() to write past shrunk_buf and corrupt the heap during GIF transcoding.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.