{"id":"CVE-2026-125250","kind":"vulnerability","aliases":["CVE-2026-125250"],"related":[],"title":"FFmpeg: crafted PAL8 video overflows heap while encoding GIF","description":"FFmpeg through 9.0.2 contains a heap buffer overflow in the GIF encoder's gif_image_write_image() in libavcodec/gif.c because shrunk_buf is sized from the first frame's linesize. Attackers can supply PAL8 video whose frame linesize grows mid-stream, causing remap_frame_to_palette() to write past shrunk_buf and corrupt the heap during GIF transcoding.","summary":"FFmpeg's GIF encoder sizes a buffer from the first frame's line length, so a video whose line length grows mid-stream makes it write past the buffer. An attacker who supplies such a file can corrupt memory during GIF transcoding, which can lead to code execution.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ffmpeg","fixed":[],"affected":"<= 9.0.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["ffmpeg","media-transcoding","package","self-hosted"],"not_affected_if":["no-gif-output","no-user-uploads"],"how_to_check":"Run `ffmpeg -version`; versions up to 9.0.2 are affected. Also check whether your build includes commit 26c2980 (`git tag --contains 26c2980` in a clone). Only matters if you encode to GIF (`-c:v gif` or .gif output) from untrusted input. Workaround until patched: do not accept untrusted video for GIF output.","fix":"Fixed upstream in commit 26c2980980295e5516f308c5a2792d2a72e43eae (libavcodec/gif.c). No release containing it is named in the sources; use a build that includes the commit or a release after 9.0.2 once confirmed.","status":"open","published_at":"2026-11-09T19:17:03+00:00","first_seen_at":"2026-11-09T19:28:21+00:00","triaged_at":"2026-11-09T19:29:28+00:00","updated_at":"2026-11-09T19:30:36+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-09T19:29:28Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"unknown","title":"FFmpeg: crafted PAL8 video overflows heap while encoding GIF","impact":"high","summary":"FFmpeg's GIF encoder sizes a buffer from the first frame's line length, so a video whose line length grows mid-stream makes it write past the buffer. An attacker who supplies such a file can corrupt memory during GIF transcoding, which can lead to code execution.","audience":"businesses","category":"package","nicknames":[],"who_cares":["ffmpeg","media-transcoding","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker corrupts heap memory, possibly running code on the server.","analyst_note":"Confirm the fixed FFmpeg version and whether the patch link on github.com names it; check whether the vulncheck advisory states exploitation requirements.","how_to_check":"- Run `ffmpeg -version` and compare against the fixed versions listed below.\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-user-uploads","no-gif-output"],"who_is_affected":"Any service that runs FFmpeg to transcode user-supplied video into GIF is exposed, because the attacker's file controls the frame sizes. Systems that only process trusted media, or that never produce GIF output, are less exposed. The sources do not list fixed versions beyond the affected range through 9.0.2.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000736,"input_tokens":4637,"output_tokens":545,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed FFmpeg version and whether the patch link on github.com names it; check whether the vulncheck advisory states exploitation requirements.","search":"'-125250':12A,15A '-2026':11A,14A '9.0.2':76C 'attack':56B,104C 'buf':95C,125C 'buffer':31B,54B,80C 'caus':116C 'code':72B 'contain':77C 'corrupt':63B,127C 'craft':2A 'cve':10A,13A 'encod':8A,28B,85C 'execut':73B 'ffmpeg':1A,16A,17B,25B,74C 'file':61B 'first':34B,100C 'frame':35B,101C,110C,118C 'gif':9A,27B,66B,84C,87C,131C 'grow':45B,112C 'heap':6A,79C,129C 'host':24B 'imag':88C,90C 'lead':70B 'length':38B,44B 'libavcodec/gif.c':92C 'line':37B,43B 'lines':103C,111C 'make':49B 'media':19B 'media-transcod':18B 'memori':64B 'mid':47B,114C 'mid-stream':46B,113C 'overflow':5A,81C 'packag':21B 'pal8':3A,107C 'palett':120C 'past':52B,123C 'remap':117C 'self':23B 'self-host':22B 'shrunk':94C,124C 'size':29B,97C 'stream':48B,115C 'suppli':58B,106C 'transcod':20B,67B,132C 'video':4A,41B,108C 'whose':42B,109C 'write':51B,89C,122C","nicknames":[],"mitigations":[],"who_affected":"Any service that runs FFmpeg to transcode user-supplied video into GIF is exposed, because the attacker's file controls the frame sizes. Systems that only process trusted media, or that never produce GIF output, are less exposed. The sources do not list fixed versions beyond the affected range through 9.0.2.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["ffmpeg"],"ptokens":["ffmpeg"],"labels":["ffmpeg","high","mediatranscoding","package","selfhosted"],"campaign_type":null,"search_a":"'-125250':12A,15A '-2026':11A,14A 'craft':2A 'cve':10A,13A 'encod':8A 'ffmpeg':1A,16A 'gif':9A 'heap':6A 'overflow':5A 'pal8':3A 'video':4A","search_b":"'attack':56B 'buffer':31B,54B 'code':72B 'corrupt':63B 'encod':28B 'execut':73B 'ffmpeg':17B,25B 'file':61B 'first':34B 'frame':35B 'gif':27B,66B 'grow':45B 'host':24B 'lead':70B 'length':38B,44B 'line':37B,43B 'make':49B 'media':19B 'media-transcod':18B 'memori':64B 'mid':47B 'mid-stream':46B 'packag':21B 'past':52B 'self':23B 'self-host':22B 'size':29B 'stream':48B 'suppli':58B 'transcod':20B,67B 'video':41B 'whose':42B 'write':51B","search_c":"'9.0.2':76C 'attack':104C 'buf':95C,125C 'buffer':80C 'caus':116C 'contain':77C 'corrupt':127C 'encod':85C 'ffmpeg':74C 'first':100C 'frame':101C,110C,118C 'gif':84C,87C,131C 'grow':112C 'heap':79C,129C 'imag':88C,90C 'libavcodec/gif.c':92C 'lines':103C,111C 'mid':114C 'mid-stream':113C 'overflow':81C 'pal8':107C 'palett':120C 'past':123C 'remap':117C 'shrunk':94C,124C 'size':97C 'stream':115C 'suppli':106C 'transcod':132C 'video':108C 'whose':109C 'write':89C,122C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T19:17:03+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125250","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125250","severity":null,"published_at":"2026-11-09T19:17:03+00:00","modified_at":"2026-11-09T19:17:03+00:00","first_seen_at":"2026-11-09T19:28:21+00:00","fetched_at":"2026-11-09T19:28:21+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-125250:2318","url":null,"severity":null,"published_at":"2026-11-09T19:30:36+00:00","modified_at":"2026-11-09T19:30:36+00:00","first_seen_at":"2026-11-09T19:30:36+00:00","fetched_at":"2026-11-09T19:30:36+00:00","note":"Read FFmpeg commit 26c2980 (libavcodec/gif.c: shrunk_buf now width-strided; found by Joshua Rogers/AISLE) and VulnCheck advisory (FFmpeg <= 9.0.2, PAL8 with growing linesize, AV:L UI:P, no exploitation or PoC stated). No release containing the fix is named in either; web-cli out of credits so no release page checked. Nothing verified."}],"documents":[{"id":109388,"url":"https://github.com/FFmpeg/FFmpeg/commit/26c2980980295e5516f308c5a2792d2a72e43eae","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109389,"url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-gif-encoder-heap-buffer-overflow-via-shrunk-buf-remap","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}