FFMPEG · CVE-2026-125257 · Package
NO FIX YET · SEE WHAT TO DO
FFmpeg's Nellymoser encoder writes one element past its allocated buffers in get_exponent_dynamic() when trellis is enabled. A crafted audio input can overwrite adjacent heap memory, which can lead to code execution or a crash.
first public Nov 9, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications and services that run FFmpeg (libavcodec) up to 9.0.2 and encode audio to Nellymoser with trellis enabled on untrusted input, such as media-processing pipelines. Teams that only decode, or never use the Nellymoser encoder, can skip it.
Not affected if no-nellymoser-encoding, trellis-disabled
Who cares ffmpeg, libavcodec, media-processing
9.0.2FFmpeg through 9.0.2 contains an off-by-one heap overflow vulnerability in get_exponent_dynamic() in libavcodec/nellymoserenc.c that allows writing one element past the opt and path allocations. Attackers can supply crafted audio to applications encoding Nellymoser with trellis enabled, causing idx to equal OPT_SIZE and overwrite adjacent heap memory.
This page as .md · .json · CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.