CVE-2026-125250: FFmpeg through 9.0.2 GIF Encoder Heap Buffer Overflow via shrunk_buf Remap

Q: Which processing workflows are affected?

The issue is triggered during GIF transcoding in the GIF encoder. Workflows that encode attacker-supplied PAL8 video to GIF are exposed when a frame’s linesize increases after the first frame.

Q: What must an attacker provide to trigger the overflow?

An attacker needs to supply PAL8 video with a frame linesize that grows mid-stream. The vulnerable remapping path then writes beyond the heap buffer allocated using the first frame’s linesize.

Q: Does exploitation require prior privileges?

No prior privileges are required according to the supplied vector. Exploitation does require user interaction and local access.

Published Nov 9, 2026

Updated

FFmpeg through 9.0.2 contains a heap buffer overflow in the GIF encoder's gifimagewriteimage() in libavcodec/gif.c because shrunkbuf is sized from the first frame's linesize. Attackers can supply PAL8 video whose frame linesize grows mid-stream, causing remapframetopalette() to write past shrunkbuf and corrupt the heap during GIF transcoding.

Affected Software

1 affected component

FFmpeg FFmpeg<=9.0.2

Event History

Nov 9, 2026

CVE Published

via MITRE·07:11 PM

Data Sourced

via MITRE·07:11 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which processing workflows are affected?

The issue is triggered during GIF transcoding in the GIF encoder. Workflows that encode attacker-supplied PAL8 video to GIF are exposed when a frame’s linesize increases after the first frame.

What must an attacker provide to trigger the overflow?

An attacker needs to supply PAL8 video with a frame linesize that grows mid-stream. The vulnerable remapping path then writes beyond the heap buffer allocated using the first frame’s linesize.

Does exploitation require prior privileges?

No prior privileges are required according to the supplied vector. Exploitation does require user interaction and local access.

CVE-2026-125250: FFmpeg through 9.0.2 GIF Encoder Heap Buffer Overflow via shrunk_buf Remap

Affected Software

Event History

Frequently Asked Questions

Which processing workflows are affected?

What must an attacker provide to trigger the overflow?

Does exploitation require prior privileges?

Company

Resources

Contact

Frequently Asked Questions

Which processing workflows are affected?

What must an attacker provide to trigger the overflow?

Does exploitation require prior privileges?