{"id":"CVE-2026-125251","kind":"vulnerability","aliases":["CVE-2026-125251"],"related":[],"title":"FFmpeg: VVC decoder integer overflow lets crafted video corrupt memory","description":"FFmpeg through 9.0.2 contains an integer overflow vulnerability in the VVC decoder alloc_frame() function in libavcodec/vvc/refs.c that undersizes the reference picture list allocation on 32-bit builds. Attackers can supply a crafted VVC (H.266) file with a very large number of NAL units per access unit to trigger heap out-of-bounds writes and corrupt memory.","summary":"FFmpeg's VVC (H.266) decoder multiplies the number of NAL units by a struct size without an overflow check in alloc_frame(). On 32-bit builds this undersizes the reference picture list buffer, so a crafted file with very many NAL units causes heap out-of-bounds writes. The maintainer fix was replicated under ASAN on an i386 build.","severity":"high","cvss":7.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ffmpeg","fixed":[],"affected":"<= 9.0.2 (32-bit builds with the VVC decoder)","ecosystem":"vendor"}],"ecosystems":[],"tags":["ffmpeg","libavcodec","media-processing","package","self-hosted"],"not_affected_if":["64-bit-build","no-vvc-input"],"how_to_check":"- Run ffmpeg -version: releases up to and including 9.0.2 are listed as affected, unless your distro backported commit 053660fd.\n- Check for a 32-bit build (i386/armhf; file $(which ffmpeg), or ffmpeg -version configuration line). The overflow was shown on i386; 64-bit is not stated to be affected.\n- Check the VVC decoder is built in: ffmpeg -decoders | grep -i vvc.\n- Also check libavcodec used as a library by other apps (media pipelines, thumbnailers) that decode untrusted video.","fix":"Fixed upstream in FFmpeg commit 053660fdb0d2403b838690689c47ad7685c3b10b (avcodec/vvc/refs: check the rpl allocation size for overflow). No release containing it is named in the sources; until one is confirmed, build from a source tree that includes the commit or apply the patch. Releases through 9.0.2 are listed as affected.","status":"open","published_at":"2026-11-09T19:17:04+00:00","first_seen_at":"2026-11-09T19:28:21+00:00","triaged_at":"2026-11-09T19:29:50+00:00","updated_at":"2026-11-09T19:30:30+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-09T19:29:50Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"FFmpeg: VVC decoder integer overflow lets crafted video corrupt memory","impact":"high","summary":"FFmpeg's VVC (H.266) decoder miscalculates a buffer size on 32-bit builds, so a crafted video file with many NAL units triggers heap out-of-bounds writes. An attacker who gets FFmpeg to open such a file can corrupt memory, which may lead to code execution.","audience":"developers","category":"package","nicknames":[],"who_cares":["ffmpeg","libavcodec","media-processing","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Crafted video file corrupts heap memory, possibly running attacker code","analyst_note":"Confirm the fixed FFmpeg version from the GitHub patch and the VulnCheck advisory, and whether the flaw is reachable on 64-bit builds.","how_to_check":"- Check whether the FFmpeg build is 32-bit and whether it includes the VVC decoder (libavcodec/vvc).\n- Run `ffmpeg -version` to see the installed version and compare it with the fixed release.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["64-bit-build","no-vvc-input"],"who_is_affected":"Systems that run FFmpeg on 32-bit builds and decode untrusted VVC (H.266) files, such as media-processing services or upload pipelines, are exposed. Teams on 64-bit builds or that never decode VVC input can likely skip it, but the sources do not confirm this.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000762,"input_tokens":4632,"output_tokens":598,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed FFmpeg version from the GitHub patch and the VulnCheck advisory, and whether the flaw is reachable on 64-bit builds.","search":"'-125251':13A,16A '-2026':12A,15A '32':50B,112C '9.0.2':89C 'access':132C 'alloc':47B,99C,110C 'asan':82B 'attack':115C 'bit':51B,113C 'bound':74B,140C 'buffer':59B 'build':52B,86B,114C 'caus':69B 'check':45B 'contain':90C 'corrupt':9A,143C 'craft':7A,62B,119C 'cve':11A,14A 'decod':3A,31B,98C 'ffmpeg':1A,17A,18B,27B,87C 'file':63B,122C 'fix':78B 'frame':48B,100C 'function':101C 'h.266':30B,121C 'heap':70B,136C 'host':26B 'i386':85B 'integ':4A,92C 'larg':126C 'let':6A 'libavcodec':19B 'libavcodec/vvc/refs.c':103C 'list':58B,109C 'maintain':77B 'mani':66B 'media':21B 'media-process':20B 'memori':10A,144C 'multipli':32B 'nal':36B,67B,129C 'number':34B,127C 'out-of-bound':71B,137C 'overflow':5A,44B,93C 'packag':23B 'per':131C 'pictur':57B,108C 'process':22B 'refer':56B,107C 'replic':80B 'self':25B 'self-host':24B 'size':41B 'struct':40B 'suppli':117C 'trigger':135C 'unders':54B,105C 'unit':37B,68B,130C,133C 'video':8A 'vulner':94C 'vvc':2A,29B,97C,120C 'without':42B 'write':75B,141C","nicknames":[],"mitigations":[],"who_affected":"Systems that run FFmpeg on 32-bit builds and decode untrusted VVC (H.266) files, such as media-processing services or upload pipelines, are exposed. Teams on 64-bit builds or that never decode VVC input can likely skip it, but the sources do not confirm this.","tier":"B","verified":{"fix":{"at":"2026-11-09T19:30:30Z","by":"analyst","doc":"https://github.com/FFmpeg/FFmpeg/commit/053660fdb0d2403b838690689c47ad7685c3b10b","run_id":2317}},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["ffmpeg"],"ptokens":["ffmpeg"],"labels":["ffmpeg","high","libavcodec","mediaprocessing","package","selfhosted"],"campaign_type":null,"search_a":"'-125251':13A,16A '-2026':12A,15A 'corrupt':9A 'craft':7A 'cve':11A,14A 'decod':3A 'ffmpeg':1A,17A 'integ':4A 'let':6A 'memori':10A 'overflow':5A 'video':8A 'vvc':2A","search_b":"'32':50B 'alloc':47B 'asan':82B 'bit':51B 'bound':74B 'buffer':59B 'build':52B,86B 'caus':69B 'check':45B 'craft':62B 'decod':31B 'ffmpeg':18B,27B 'file':63B 'fix':78B 'frame':48B 'h.266':30B 'heap':70B 'host':26B 'i386':85B 'libavcodec':19B 'list':58B 'maintain':77B 'mani':66B 'media':21B 'media-process':20B 'multipli':32B 'nal':36B,67B 'number':34B 'out-of-bound':71B 'overflow':44B 'packag':23B 'pictur':57B 'process':22B 'refer':56B 'replic':80B 'self':25B 'self-host':24B 'size':41B 'struct':40B 'unders':54B 'unit':37B,68B 'vvc':29B 'without':42B 'write':75B","search_c":"'32':112C '9.0.2':89C 'access':132C 'alloc':99C,110C 'attack':115C 'bit':113C 'bound':140C 'build':114C 'contain':90C 'corrupt':143C 'craft':119C 'decod':98C 'ffmpeg':87C 'file':122C 'frame':100C 'function':101C 'h.266':121C 'heap':136C 'integ':92C 'larg':126C 'libavcodec/vvc/refs.c':103C 'list':109C 'memori':144C 'nal':129C 'number':127C 'out-of-bound':137C 'overflow':93C 'per':131C 'pictur':108C 'refer':107C 'suppli':117C 'trigger':135C 'unders':105C 'unit':130C,133C 'vulner':94C 'vvc':97C,120C 'write':141C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T19:17:04+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125251","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125251","severity":null,"published_at":"2026-11-09T19:17:04+00:00","modified_at":"2026-11-09T19:17:04+00:00","first_seen_at":"2026-11-09T19:28:21+00:00","fetched_at":"2026-11-09T19:28:21+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-125251:2317","url":null,"severity":null,"published_at":"2026-11-09T19:30:30+00:00","modified_at":"2026-11-09T19:30:30+00:00","first_seen_at":"2026-11-09T19:30:30+00:00","fetched_at":"2026-11-09T19:30:30+00:00","note":"Exa unavailable (no credits); read commit and VulnCheck via WebFetch. Commit by Niedermayer, found by Joshua Rogers (AISLE), repro on i386. VulnCheck names no fixed release, no exploitation or PoC. 64-bit not-affected is implied, not stated. Fix field not marked verified: commit page was read via fetch summary, no release."}],"documents":[{"id":109390,"url":"https://github.com/FFmpeg/FFmpeg/commit/053660fdb0d2403b838690689c47ad7685c3b10b","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109391,"url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-vvc-decoder-heap-out-of-bounds-write-via-refs-c","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}