CVE-2026-125194: FFmpeg through 9.0.2 Out-of-Bounds Read via PCM DVD Encoder

Q: Who is realistically exposed to this issue?

Systems that use FFmpeg to transcode attacker-supplied audio into PCM DVD output are exposed. The vulnerable path requires 24-bit audio at 48 kHz or 96 kHz with a final frame shorter than one block.

Q: What does an attacker need to do to trigger the crash?

An attacker must cause the transcoding process to handle crafted 24-bit, 48 or 96 kHz audio whose sample length leaves a short final frame. Exploitation causes the encoder loop counter to wrap, leading to an out-of-bounds read and process crash.

Q: Is this a remote issue by default?

The stated attack vector is local and user interaction is required. The provided data does not establish that a default FFmpeg installation will process untrusted input through the PCM DVD encoder.

Q: How can I determine whether my workflow is affected?

Check whether your FFmpeg usage invokes the PCM DVD encoder and processes 24-bit 48 kHz or 96 kHz audio. Workflows that can receive files with a short final frame should be treated as affected on FFmpeg versions through 9.0.2.

Published Nov 9, 2026

Updated

FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in pcmdvdencodeframe() in libavcodec/pcm-dvdenc.c when a 24-bit final frame holds fewer samples than one block. Attackers can supply 24-bit 48 or 96 kHz audio whose length leaves a short final frame, causing the loop counter to wrap and crash the transcoding process.

Affected Software

1 affected component

FFmpeg FFmpeg<=9.0.2

Event History

Nov 9, 2026

CVE Published

via MITRE·07:11 PM

Data Sourced

via MITRE·07:11 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is realistically exposed to this issue?

Systems that use FFmpeg to transcode attacker-supplied audio into PCM DVD output are exposed. The vulnerable path requires 24-bit audio at 48 kHz or 96 kHz with a final frame shorter than one block.

What does an attacker need to do to trigger the crash?

An attacker must cause the transcoding process to handle crafted 24-bit, 48 or 96 kHz audio whose sample length leaves a short final frame. Exploitation causes the encoder loop counter to wrap, leading to an out-of-bounds read and process crash.

Is this a remote issue by default?

The stated attack vector is local and user interaction is required. The provided data does not establish that a default FFmpeg installation will process untrusted input through the PCM DVD encoder.

How can I determine whether my workflow is affected?

Check whether your FFmpeg usage invokes the PCM DVD encoder and processes 24-bit 48 kHz or 96 kHz audio. Workflows that can receive files with a short final frame should be treated as affected on FFmpeg versions through 9.0.2.

CVE-2026-125194: FFmpeg through 9.0.2 Out-of-Bounds Read via PCM DVD Encoder

Affected Software

Event History

Frequently Asked Questions

Who is realistically exposed to this issue?

What does an attacker need to do to trigger the crash?

Is this a remote issue by default?

How can I determine whether my workflow is affected?

Company

Resources

Contact

Frequently Asked Questions

Who is realistically exposed to this issue?

What does an attacker need to do to trigger the crash?

Is this a remote issue by default?

How can I determine whether my workflow is affected?