FFMPEG · CVE-2026-125251 · Package
NO FIX YET · SEE WHAT TO DO
FFmpeg's VVC (H.266) decoder multiplies the number of NAL units by a struct size without an overflow check in alloc_frame(). On 32-bit builds this undersizes the reference picture list buffer, so a crafted file with very many NAL units causes heap out-of-bounds writes. The maintainer fix was replicated under ASAN on an i386 build.
first public Nov 9, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Systems that run FFmpeg on 32-bit builds and decode untrusted VVC (H.266) files, such as media-processing services or upload pipelines, are exposed. Teams on 64-bit builds or that never decode VVC input can likely skip it, but the sources do not confirm this.
Not affected if 64-bit-build, no-vvc-input
Who cares ffmpeg, libavcodec, media-processing, self-hosted
FFmpeg through 9.0.2 contains an integer overflow vulnerability in the VVC decoder alloc_frame() function in libavcodec/vvc/refs.c that undersizes the reference picture list allocation on 32-bit builds. Attackers can supply a crafted VVC (H.266) file with a very large number of NAL units per access unit to trigger heap out-of-bounds writes and corrupt memory.
This page as .md · .json · CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
9.0.2 are listed as affected