CVE-2026-125180: FFmpeg 8.1 through 9.0.2 EXIF Parser Memory Exhaustion via Overlapping Tags
FFmpeg 8.1 through 9.0.2 contains a memory exhaustion vulnerability in the libavcodec/exif.c parser that allows attackers to amplify allocations by pointing many IFD entries at overlapping payloads. Attackers can embed a small crafted EXIF block in TIFF, JPEG, PNG or WebP images to trigger quadratic memory allocation, causing denial of service in decoding applications.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using FFmpeg versions 8.1 through 9.0.2 are exposed when they decode TIFF, JPEG, PNG, or WebP images containing EXIF metadata. Applications that process attacker-supplied or otherwise untrusted images are the most relevant exposure cases.
What is required to trigger the issue?
An attacker must provide an image containing a small crafted EXIF block with overlapping IFD tag payloads and have the target application decode it. The supplied vector indicates no privileges are required, but user interaction is required.
How can I assess whether an application is affected?
Confirm the FFmpeg version in use and whether it falls from 8.1 through 9.0.2. Then identify image-decoding paths that use FFmpeg and may process TIFF, JPEG, PNG, or WebP files with EXIF metadata.