CVE-2026-125211: FFmpeg through 9.0.2 Heap Corruption via libaribcaption ASS Error Cleanup

Q: What input must an attacker control to trigger this issue?

An attacker must be able to supply a crafted ARIB caption. The caption must cause a later region to exceed the 8 KiB AVBPrint limit, which invokes the vulnerable error-cleanup path.

Q: What are the likely consequences if exploitation succeeds?

The cleanup path can read out of bounds and free invalid pointers, corrupting the heap. The provided severity vector rates confidentiality, integrity, and availability impacts as high.

Q: Is this remotely exploitable without user interaction?

The supplied CVSS vector identifies local attack vector, high attack complexity, no required privileges, and required user interaction. The data does not establish a network-reachable attack path.

Q: Which FFmpeg versions are known to be affected?

The issue is described as affecting FFmpeg through version 9.0.2. The referenced FFmpeg commit is 4ec127c82678b06658e963291f272881dc878735.

Published Nov 9, 2026

Updated

FFmpeg through 9.0.2 contains an out-of-bounds read and invalid free vulnerability in aribcaptiontransasssubtitle() in libavcodec/libaribcaption.c that frees subtitle rectangles using regioncount instead of numrects. Attackers can supply crafted ARIB captions whose later region exceeds the 8 KiB AVBPrint limit, triggering cleanup that frees out-of-bounds pointers and corrupts the heap.

Affected Software

1 affected component

FFmpeg FFmpeg<=9.0.2

Event History

Nov 9, 2026

CVE Published

via MITRE·07:11 PM

Data Sourced

via MITRE·07:11 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What input must an attacker control to trigger this issue?

An attacker must be able to supply a crafted ARIB caption. The caption must cause a later region to exceed the 8 KiB AVBPrint limit, which invokes the vulnerable error-cleanup path.

What are the likely consequences if exploitation succeeds?

The cleanup path can read out of bounds and free invalid pointers, corrupting the heap. The provided severity vector rates confidentiality, integrity, and availability impacts as high.

Is this remotely exploitable without user interaction?

The supplied CVSS vector identifies local attack vector, high attack complexity, no required privileges, and required user interaction. The data does not establish a network-reachable attack path.

Which FFmpeg versions are known to be affected?

The issue is described as affecting FFmpeg through version 9.0.2. The referenced FFmpeg commit is 4ec127c82678b06658e963291f272881dc878735.

CVE-2026-125211: FFmpeg through 9.0.2 Heap Corruption via libaribcaption ASS Error Cleanup

Affected Software

Event History

Frequently Asked Questions

What input must an attacker control to trigger this issue?

What are the likely consequences if exploitation succeeds?

Is this remotely exploitable without user interaction?

Which FFmpeg versions are known to be affected?

Company

Resources

Contact

Frequently Asked Questions

What input must an attacker control to trigger this issue?

What are the likely consequences if exploitation succeeds?

Is this remotely exploitable without user interaction?

Which FFmpeg versions are known to be affected?