CVE-2026-125257: FFmpeg through 9.0.2 Heap Overflow via Nellymoser Encoder Trellis Search

Q: Which deployments are exposed to this issue?

Applications using FFmpeg through 9.0.2 are exposed when they encode attacker-supplied audio with the Nellymoser encoder and trellis search is enabled. The provided data does not establish that default FFmpeg encoder settings enable trellis.

Q: What does an attacker need to exploit it?

An attacker needs to provide crafted audio to an application that performs Nellymoser encoding with trellis enabled. The vulnerability is triggered when the encoder's trellis search reaches an index equal to OPT_SIZE, causing a write past the opt and path heap allocations.

Q: How can I determine whether my application may be affected?

Check whether your application uses FFmpeg 9.0.2 or an earlier version and invokes the Nellymoser encoder. Then verify whether trellis is enabled for that encoding path and whether untrusted or attacker-controlled audio can reach it.

Published Nov 9, 2026

Updated

FFmpeg through 9.0.2 contains an off-by-one heap overflow vulnerability in getexponentdynamic() in libavcodec/nellymoserenc.c that allows writing one element past the opt and path allocations. Attackers can supply crafted audio to applications encoding Nellymoser with trellis enabled, causing idx to equal OPTSIZE and overwrite adjacent heap memory.

Affected Software

1 affected component

FFmpeg FFmpeg<=9.0.2

Event History

Nov 9, 2026

CVE Published

via MITRE·07:12 PM

Data Sourced

via MITRE·07:12 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·08:18 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Applications using FFmpeg through 9.0.2 are exposed when they encode attacker-supplied audio with the Nellymoser encoder and trellis search is enabled. The provided data does not establish that default FFmpeg encoder settings enable trellis.

What does an attacker need to exploit it?

An attacker needs to provide crafted audio to an application that performs Nellymoser encoding with trellis enabled. The vulnerability is triggered when the encoder's trellis search reaches an index equal to OPT_SIZE, causing a write past the opt and path heap allocations.

How can I determine whether my application may be affected?

Check whether your application uses FFmpeg 9.0.2 or an earlier version and invokes the Nellymoser encoder. Then verify whether trellis is enabled for that encoding path and whether untrusted or attacker-controlled audio can reach it.

CVE-2026-125257: FFmpeg through 9.0.2 Heap Overflow via Nellymoser Encoder Trellis Search

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

How can I determine whether my application may be affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

How can I determine whether my application may be affected?