FFMPEG · CVE-2026-125261 · Package
NO FIX YET
FFmpeg's SGI image encoder in libavcodec mishandles negative linesize values through unsigned size variables, causing an out-of-bounds read. An attacker who supplies a crafted video with a display matrix that triggers autorotate vertical flip can crash the process while it transcodes to SGI images.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Exposure needs FFmpeg through 9.0.2 processing attacker-supplied video and encoding it to SGI format, so the risk sits in services that transcode user media. The sources describe a crash rather than code execution. Teams that never transcode untrusted input to SGI can skip it.
Not affected if no-sgi-output, no-untrusted-video-input
Who cares ffmpeg, media-processing, transcoding
9.0.2 or earlier, for example with ffmpeg -versionNo fix yet, per the sources.
FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in the SGI encoder's encode_frame() in libavcodec/sgienc.c, where unsigned size variables mis-handle negative linesize frames. Attackers can supply a video whose display matrix triggers autorotate vflip, so transcoding to SGI images reads pixel data far outside the frame and crashes the process.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.