{"id":"CVE-2026-125259","kind":"vulnerability","aliases":["CVE-2026-125259"],"related":[],"title":"FFmpeg: integer overflow in ProRes encoder corrupts heap memory","description":"FFmpeg through 9.0.2 contains an integer overflow vulnerability in ff_prores_kostya_encode_init() that miscalculates frame_size_upper_bound using 32-bit arithmetic for large frame dimensions. Attackers can supply a high-resolution video transcoded with the prores_ks encoder, causing encode_frame() to write slices past an undersized packet buffer and corrupt heap memory.","summary":"FFmpeg miscalculates the buffer size for ProRes video encoding when frames are very large, because it uses 32-bit arithmetic. An attacker who supplies a high-resolution video transcoded with the prores_ks encoder can write past an undersized packet buffer and corrupt heap memory.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ffmpeg","fixed":[],"affected":"<= 9.0.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["ffmpeg","heap-overflow","package","prores","prores_ks","video-transcoding"],"not_affected_if":["no-prores-ks-encoding","no-prores_ks-encoding","trusted-input-only"],"how_to_check":"Run ffmpeg -version; releases through 9.0.2 are listed as affected. Only matters if you transcode untrusted video with the prores_ks encoder (check scripts/services for -c:v prores_ks or -c:v prores_ks via libavcodec). Check whether your build's proresenc_kostya_common.c has the 'Frame too large to encode' check.","fix":"No fixed release named in sources. Fixed in FFmpeg git commit 439b452f (avcodec/proresenc_kostya: compute frame size upper bound in 64 bits); build from a source tree containing it or wait for a release newer than 9.0.2.","status":"open","published_at":"2026-11-09T20:18:12+00:00","first_seen_at":"2026-11-09T20:48:13+00:00","triaged_at":"2026-11-09T20:49:39+00:00","updated_at":"2026-11-09T20:50:55+00:00","category":"package","confidence":0.75,"triage":{"at":"2026-11-09T20:49:39Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"FFmpeg: integer overflow in ProRes encoder corrupts heap memory","impact":"high","summary":"FFmpeg miscalculates the buffer size for ProRes video encoding when frames are very large, because it uses 32-bit arithmetic. An attacker who supplies a high-resolution video transcoded with the prores_ks encoder can write past an undersized packet buffer and corrupt heap memory.","audience":"businesses","category":"package","nicknames":[],"who_cares":["ffmpeg","video-transcoding","prores"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"heap memory corruption, possibly code execution on the transcoding host","analyst_note":"Confirm the fixed version and patch contents from the linked GitHub patch and the VulnCheck advisory, and whether code execution is demonstrated.","how_to_check":"- Check the installed FFmpeg version with `ffmpeg -version`; the description covers releases through `9.0.2`.\n- Look for services that transcode user-supplied video with the `prores_ks` encoder.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-prores-ks-encoding","trusted-input-only"],"who_is_affected":"Systems that run FFmpeg to encode ProRes video from user-supplied or untrusted high-resolution input are exposed. Installations that only process trusted local media, or never use the prores_ks encoder, are less exposed. The sources do not state a fixed version; a patch link is listed but its contents were not provided.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000759,"input_tokens":4639,"output_tokens":591,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed version and patch contents from the linked GitHub patch and the VulnCheck advisory, and whether code execution is demonstrated.","search":"'-125259':12A,15A '-2026':11A,14A '32':45B,95C '9.0.2':76C 'arithmet':47B,97C 'attack':49B,102C 'bit':46B,96C 'bound':93C 'buffer':31B,69B,126C 'caus':116C 'contain':77C 'corrupt':7A,71B,128C 'cve':10A,13A 'dimens':101C 'encod':6A,36B,62B,86C,115C,117C 'ff':83C 'ffmpeg':1A,16A,17B,28B,74C 'frame':38B,90C,100C,118C 'heap':8A,19B,72B,129C 'heap-overflow':18B 'high':54B,107C 'high-resolut':53B,106C 'init':87C 'integ':2A,79C 'kostya':85C 'ks':24B,61B,114C 'larg':41B,99C 'memori':9A,73B,130C 'miscalcul':29B,89C 'overflow':3A,20B,80C 'packag':21B 'packet':68B,125C 'past':65B,122C 'prore':5A,22B,23B,34B,60B,84C,113C 'resolut':55B,108C 'size':32B,91C 'slice':121C 'suppli':51B,104C 'transcod':27B,57B,110C 'unders':67B,124C 'upper':92C 'use':44B,94C 'video':26B,35B,56B,109C 'video-transcod':25B 'vulner':81C 'write':64B,120C","nicknames":[],"mitigations":[],"who_affected":"Systems that run FFmpeg to encode ProRes video from user-supplied or untrusted high-resolution input are exposed. Installations that only process trusted local media, or never use the prores_ks encoder, are less exposed. The sources do not state a fixed version; a patch link is listed but its contents were not provided.","tier":"B","verified":{"fix":{"at":"2026-11-09T20:50:55Z","by":"analyst","doc":"https://github.com/FFmpeg/FFmpeg/commit/439b452f9fe916a9f7d8788ab6afee8fac846b0b","run_id":2345}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["ffmpeg"],"ptokens":["ffmpeg"],"labels":["ffmpeg","heapoverflow","high","package","prores","proresks","videotranscoding"],"campaign_type":null,"search_a":"'-125259':12A,15A '-2026':11A,14A 'corrupt':7A 'cve':10A,13A 'encod':6A 'ffmpeg':1A,16A 'heap':8A 'integ':2A 'memori':9A 'overflow':3A 'prore':5A","search_b":"'32':45B 'arithmet':47B 'attack':49B 'bit':46B 'buffer':31B,69B 'corrupt':71B 'encod':36B,62B 'ffmpeg':17B,28B 'frame':38B 'heap':19B,72B 'heap-overflow':18B 'high':54B 'high-resolut':53B 'ks':24B,61B 'larg':41B 'memori':73B 'miscalcul':29B 'overflow':20B 'packag':21B 'packet':68B 'past':65B 'prore':22B,23B,34B,60B 'resolut':55B 'size':32B 'suppli':51B 'transcod':27B,57B 'unders':67B 'use':44B 'video':26B,35B,56B 'video-transcod':25B 'write':64B","search_c":"'32':95C '9.0.2':76C 'arithmet':97C 'attack':102C 'bit':96C 'bound':93C 'buffer':126C 'caus':116C 'contain':77C 'corrupt':128C 'dimens':101C 'encod':86C,115C,117C 'ff':83C 'ffmpeg':74C 'frame':90C,100C,118C 'heap':129C 'high':107C 'high-resolut':106C 'init':87C 'integ':79C 'kostya':85C 'ks':114C 'larg':99C 'memori':130C 'miscalcul':89C 'overflow':80C 'packet':125C 'past':122C 'prore':84C,113C 'resolut':108C 'size':91C 'slice':121C 'suppli':104C 'transcod':110C 'unders':124C 'upper':92C 'use':94C 'video':109C 'vulner':81C 'write':120C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T20:18:12+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125259","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125259","severity":null,"published_at":"2026-11-09T20:18:12+00:00","modified_at":"2026-11-09T20:18:12+00:00","first_seen_at":"2026-11-09T20:48:13+00:00","fetched_at":"2026-11-09T20:48:13+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-125259:2345","url":null,"severity":null,"published_at":"2026-11-09T20:50:55+00:00","modified_at":"2026-11-09T20:50:55+00:00","first_seen_at":"2026-11-09T20:50:55+00:00","fetched_at":"2026-11-09T20:50:55+00:00","note":"Read commit (16+/9-: 64-bit bound, new EINVAL check on oversize frames, credit Joshua Rogers/AISLE) and VulnCheck advisory (CVSS 8.5, AV:L, UI:P, <=9.0.2). No fixed release stated; no exploitation or PoC stated; code execution not demonstrated, only heap corruption. web-cli out of Exa credits, used WebFetch; no social search done."}],"documents":[{"id":109729,"url":"https://github.com/FFmpeg/FFmpeg/commit/439b452f9fe916a9f7d8788ab6afee8fac846b0b","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109730,"url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-heap-buffer-overflow-via-prores-prores-ks-encoder","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}