CVE-2026-125247: FFmpeg through 9.0.2 Integer Overflow via dng_decode_tiles() in libavcodec/tiff.c
Published Nov 9, 2026
·Updated
FFmpeg through 9.0.2 contains an integer overflow vulnerability in dngdecodetiles() that allows attackers to leak uninitialized memory via crafted DNG tile dimensions. Attackers can set TileWidth or TileLength near INTMAX so the tile loop never runs, outputting a frame exposing uninitialized or stale heap memory.
Affected Software
1 affected component
FFmpeg FFmpeg<=9.0.2
Event History
Nov 9, 2026
CVE Published
via MITRE·07:11 PM
Data Sourced
via MITRE·07:11 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·07:17 PM
DescriptionSeverityWeakness