CVE-2026-125214: FFmpeg through 9.0.2 Heap Buffer Overflow in Blu-ray PCM Decoder

Q: Which systems are exposed?

The issue affects FFmpeg through version 9.0.2 when it runs on a big-endian host and decodes Blu-ray LPCM content. Deployments that do not process this codec or do not run on big-endian hosts are not described as affected.

Q: What does exploitation require?

An attacker must provide a crafted Blu-ray M2TS LPCM stream with a payload length that is not a multiple of the sample size. The supplied CVSS vector also indicates local attack access, high attack complexity, no required privileges, and user interaction.

Q: What can be done before an update is available?

Avoid decoding untrusted Blu-ray M2TS LPCM streams on affected big-endian systems. Restricting exposure to attacker-supplied media removes the crafted input needed to trigger the overflow.

Q: How can I determine whether my environment needs attention?

Check whether FFmpeg version 9.0.2 or an earlier version is deployed on a big-endian host, and whether it is used to decode Blu-ray LPCM streams. Those conditions match the affected scenario described.

Published Nov 9, 2026

Updated

FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in pcmbluraydecodeframe() in libavcodec/pcm-bluray.c on big-endian hosts. Attackers can supply a crafted Blu-ray (M2TS) LPCM stream whose payload length is not a multiple of the sample size, writing attacker-controlled bytes past the audio frame buffer.

Affected Software

1 affected component

FFmpeg FFmpeg<=9.0.2

Event History

Nov 9, 2026

CVE Published

via MITRE·07:11 PM

Data Sourced

via MITRE·07:11 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which systems are exposed?

The issue affects FFmpeg through version 9.0.2 when it runs on a big-endian host and decodes Blu-ray LPCM content. Deployments that do not process this codec or do not run on big-endian hosts are not described as affected.

What does exploitation require?

An attacker must provide a crafted Blu-ray M2TS LPCM stream with a payload length that is not a multiple of the sample size. The supplied CVSS vector also indicates local attack access, high attack complexity, no required privileges, and user interaction.

What can be done before an update is available?

Avoid decoding untrusted Blu-ray M2TS LPCM streams on affected big-endian systems. Restricting exposure to attacker-supplied media removes the crafted input needed to trigger the overflow.

How can I determine whether my environment needs attention?

Check whether FFmpeg version 9.0.2 or an earlier version is deployed on a big-endian host, and whether it is used to decode Blu-ray LPCM streams. Those conditions match the affected scenario described.

CVE-2026-125214: FFmpeg through 9.0.2 Heap Buffer Overflow in Blu-ray PCM Decoder

Affected Software

Event History

Frequently Asked Questions

Which systems are exposed?

What does exploitation require?

What can be done before an update is available?

How can I determine whether my environment needs attention?

Company

Resources

Contact

Frequently Asked Questions

Which systems are exposed?

What does exploitation require?

What can be done before an update is available?

How can I determine whether my environment needs attention?