CVE-2026-125233: FFmpeg through 9.0.2 Heap Buffer Overflow via DVB Subtitle Encoder

Q: Which workflows are exposed to this issue?

Workflows that transcode attacker-supplied files to the DVB subtitle encoder are exposed, particularly when the input contains many bitmap subtitle rectangles. The vulnerable code is in dvbsub_encode() in libavcodec/dvbsubenc.c.

Q: What does an attacker need to do to trigger the vulnerability?

An attacker needs to provide a file containing many bitmap subtitle rectangles and have it processed through transcoding to the DVB subtitle encoder. The malformed subtitle content causes the encoder to write past its output buffer and corrupt heap memory.

Q: Which versions are affected?

FFmpeg through version 9.0.2 is affected. The provided references include a commit associated with the fix, but no fixed release version is specified.

Published Nov 9, 2026

Updated

FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in dvbsubencode() in libavcodec/dvbsubenc.c that undercounts each CLUT segment header by two bytes. Attackers can supply a file with many bitmap subtitle rectangles that, when transcoded to the dvbsub encoder, writes past the output buffer and corrupts heap memory.

Affected Software

1 affected component

FFmpeg FFmpeg<=9.0.2

Event History

Nov 9, 2026

CVE Published

via MITRE·07:11 PM

Data Sourced

via MITRE·07:11 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which workflows are exposed to this issue?

Workflows that transcode attacker-supplied files to the DVB subtitle encoder are exposed, particularly when the input contains many bitmap subtitle rectangles. The vulnerable code is in dvbsub_encode() in libavcodec/dvbsubenc.c.

What does an attacker need to do to trigger the vulnerability?

An attacker needs to provide a file containing many bitmap subtitle rectangles and have it processed through transcoding to the DVB subtitle encoder. The malformed subtitle content causes the encoder to write past its output buffer and corrupt heap memory.

Which versions are affected?

FFmpeg through version 9.0.2 is affected. The provided references include a commit associated with the fix, but no fixed release version is specified.

CVE-2026-125233: FFmpeg through 9.0.2 Heap Buffer Overflow via DVB Subtitle Encoder

Affected Software

Event History

Frequently Asked Questions

Which workflows are exposed to this issue?

What does an attacker need to do to trigger the vulnerability?

Which versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Which workflows are exposed to this issue?

What does an attacker need to do to trigger the vulnerability?

Which versions are affected?