CVE-2026-125253: FFmpeg through 9.0.2 VP9 CBS Superframe Integer Overflow Out-of-Bounds Read

Q: Which deployments are realistically affected?

The issue affects 32-bit applications using FFmpeg through 9.0.2 when they process VP9 packets. The described impact is an out-of-bounds read that can crash the application.

Q: What does an attacker need to exploit this issue?

An attacker needs to cause the application to process a crafted VP9 packet containing a forged superframe index with frame sizes near 2^32. The supplied vector indicates local access, high attack complexity, no privileges, and user interaction.

Q: Are 64-bit FFmpeg applications affected by the described overflow?

The description specifically attributes the size-check wraparound to 32-bit builds. It does not identify 64-bit builds as affected.

Published Nov 9, 2026

Updated

FFmpeg through 9.0.2 contains an integer overflow in cbsvp9splitfragment() in libavcodec/cbsvp9.c that wraps the superframe size check on 32-bit builds. Attackers can supply a crafted VP9 packet with a forged superframe index containing near-2^32 frame sizes, causing out-of-bounds reads that crash 32-bit applications.

Affected Software

1 affected component

FFmpeg FFmpeg<=9.0.2

Event History

Nov 9, 2026

CVE Published

via MITRE·07:11 PM

Data Sourced

via MITRE·07:11 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are realistically affected?

The issue affects 32-bit applications using FFmpeg through 9.0.2 when they process VP9 packets. The described impact is an out-of-bounds read that can crash the application.

What does an attacker need to exploit this issue?

An attacker needs to cause the application to process a crafted VP9 packet containing a forged superframe index with frame sizes near 2^32. The supplied vector indicates local access, high attack complexity, no privileges, and user interaction.

Are 64-bit FFmpeg applications affected by the described overflow?

The description specifically attributes the size-check wraparound to 32-bit builds. It does not identify 64-bit builds as affected.

CVE-2026-125253: FFmpeg through 9.0.2 VP9 CBS Superframe Integer Overflow Out-of-Bounds Read

Affected Software

Event History

Frequently Asked Questions

Which deployments are realistically affected?

What does an attacker need to exploit this issue?

Are 64-bit FFmpeg applications affected by the described overflow?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are realistically affected?

What does an attacker need to exploit this issue?

Are 64-bit FFmpeg applications affected by the described overflow?