CVE-2026-125100: FFmpeg through 9.0.2 Integer Overflow in OpenEXR Decoder Tile Count

Q: Who is exposed to this issue?

Systems that decode attacker-controlled tiled OpenEXR images using FFmpeg are exposed. The issue requires local attack vector conditions and user interaction, consistent with a user opening or otherwise processing a crafted image.

Q: What does an attacker need to provide?

The attacker needs a crafted tiled OpenEXR image with large dimensions and small tile sizes. This triggers an integer overflow in the tiled block-count calculation in the OpenEXR decoder's decode_frame() path.

Q: What is the potential impact?

The malformed image can cause decoding to be skipped and may disclose uninitialized memory or stale frame data. The provided severity vector indicates confidentiality impact only, with no stated integrity or availability impact.

Q: Which FFmpeg versions are affected?

FFmpeg through version 9.0.2 is identified as affected. The provided commit reference is c05d46ea2919da83233bf4216d3f58428bb54c59.

Published Nov 9, 2026

Updated

FFmpeg through 9.0.2 contains an integer overflow vulnerability in the OpenEXR decoder's decodeframe() in libavcodec/exr.c that miscalculates the tiled block count. Attackers can supply a crafted tiled OpenEXR image with large dimensions and small tiles to skip decoding and disclose uninitialized memory or stale frame data.

Affected Software

1 affected component

FFmpeg FFmpeg<=9.0.2

Event History

Nov 9, 2026

CVE Published

via MITRE·07:10 PM

Data Sourced

via MITRE·07:10 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Systems that decode attacker-controlled tiled OpenEXR images using FFmpeg are exposed. The issue requires local attack vector conditions and user interaction, consistent with a user opening or otherwise processing a crafted image.

What does an attacker need to provide?

The attacker needs a crafted tiled OpenEXR image with large dimensions and small tile sizes. This triggers an integer overflow in the tiled block-count calculation in the OpenEXR decoder's decode_frame() path.

What is the potential impact?

The malformed image can cause decoding to be skipped and may disclose uninitialized memory or stale frame data. The provided severity vector indicates confidentiality impact only, with no stated integrity or availability impact.

Which FFmpeg versions are affected?

FFmpeg through version 9.0.2 is identified as affected. The provided commit reference is c05d46ea2919da83233bf4216d3f58428bb54c59.

CVE-2026-125100: FFmpeg through 9.0.2 Integer Overflow in OpenEXR Decoder Tile Count

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to provide?

What is the potential impact?

Which FFmpeg versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to provide?

What is the potential impact?

Which FFmpeg versions are affected?