CVE-2026-125218: FFmpeg through 9.0.2 APNG Encoder Heap Buffer Overflow via encode_apng()

Q: Which deployments are exposed to this issue?

Applications using FFmpeg's APNG encoder are exposed when they process media in which the frame resolution grows during the stream. The described impact occurs in transcoding applications that encode such attacker-supplied input.

Q: What must an attacker provide to trigger the overflow?

An attacker needs to supply crafted media containing a mid-stream frame-size increase. Exploitation also requires the affected application to encode the content as APNG and reach the APNG_DISPOSE_OP_BACKGROUND handling path.

Q: What happens when the vulnerability is triggered?

The APNG encoder can perform memset writes beyond the prev_frame heap buffer. This can crash the transcoding application or corrupt heap memory.

Q: How can I determine whether a system may be affected?

Check whether the deployment uses FFmpeg through 9.0.2 and enables or invokes APNG encoding. Systems that do not use the APNG encoder are not described as reaching the vulnerable encode_apng() path.

Published Nov 9, 2026

Updated

FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in the APNG encoder's encodeapng() function in libavcodec/pngenc.c when frame size changes mid-stream. Attackers can supply crafted media whose resolution grows mid-stream, causing APNGDISPOSEOPBACKGROUND memset writes past prevframe and crashing or corrupting heap memory in transcoding applications.

Affected Software

1 affected component

FFmpeg FFmpeg<=9.0.2

Event History

Nov 9, 2026

CVE Published

via MITRE·07:11 PM

Data Sourced

via MITRE·07:11 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Applications using FFmpeg's APNG encoder are exposed when they process media in which the frame resolution grows during the stream. The described impact occurs in transcoding applications that encode such attacker-supplied input.

What must an attacker provide to trigger the overflow?

An attacker needs to supply crafted media containing a mid-stream frame-size increase. Exploitation also requires the affected application to encode the content as APNG and reach the APNG_DISPOSE_OP_BACKGROUND handling path.

What happens when the vulnerability is triggered?

The APNG encoder can perform memset writes beyond the prev_frame heap buffer. This can crash the transcoding application or corrupt heap memory.

How can I determine whether a system may be affected?

Check whether the deployment uses FFmpeg through 9.0.2 and enables or invokes APNG encoding. Systems that do not use the APNG encoder are not described as reaching the vulnerable encode_apng() path.

CVE-2026-125218: FFmpeg through 9.0.2 APNG Encoder Heap Buffer Overflow via encode_apng()

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What must an attacker provide to trigger the overflow?

What happens when the vulnerability is triggered?

How can I determine whether a system may be affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What must an attacker provide to trigger the overflow?

What happens when the vulnerability is triggered?

How can I determine whether a system may be affected?