FFMPEG · CVE-2026-125253 · Runtime
NO FIX YET
FFmpeg's VP9 superframe parser miscalculates frame sizes on 32-bit builds due to an integer overflow in cbs_vp9_split_fragment(). A crafted VP9 packet with a forged superframe index causes out-of-bounds reads that crash the application.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications that decode untrusted VP9 media on 32-bit FFmpeg builds are the exposed case, since the overflow only wraps the size check there. The sources describe a crash (out-of-bounds read), not code execution. Systems that only process trusted media or run 64-bit builds can likely skip it, but the sources do not state this explicitly.
Not affected if 64-bit-build, trusted-input-only
Who cares 32-bit, ffmpeg, libavcodec, vp9
ffmpeg -version, and compare it against the fixed version.No fix yet, per the sources.
FFmpeg through 9.0.2 contains an integer overflow in cbs_vp9_split_fragment() in libavcodec/cbs_vp9.c that wraps the superframe size check on 32-bit builds. Attackers can supply a crafted VP9 packet with a forged superframe index containing near-2^32 frame sizes, causing out-of-bounds reads that crash 32-bit applications.
This page as .md · .json · CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.