CVE-2026-125260: FFmpeg through 9.0.2 Heap Buffer Overflow in EXR Encoder RLE Path

Q: Which workflows are exposed to this issue?

Workflows that transcode attacker-controlled input to OpenEXR using RLE compression are exposed. The crafted input must cause the frame resolution to grow mid-stream so that processed frames become taller than the encoder height.

Q: What level of attacker access is required?

The attacker does not need privileges, but exploitation requires local access and user interaction. They must be able to provide crafted media that is processed by the affected transcoding workflow.

Q: How can I determine whether a deployment is affected?

Check whether the deployment uses FFmpeg through version 9.0.2 and whether it encodes to OpenEXR with RLE compression. Affected processing can write past the scanline array, corrupt heap memory, and crash the application.

Published Nov 9, 2026

Updated

FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in libavcodec/exrenc.c that allows attackers to corrupt heap memory when encodescanlinerle() processes frames taller than the encoder height. Attackers can supply crafted input whose resolution grows mid-stream, transcoded to OpenEXR with RLE compression, to write pointers past the scanline array and crash the application.

Affected Software

1 affected component

FFmpeg FFmpeg<=9.0.2

Event History

Nov 9, 2026

CVE Published

via MITRE·07:12 PM

Data Sourced

via MITRE·07:12 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·08:18 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which workflows are exposed to this issue?

Workflows that transcode attacker-controlled input to OpenEXR using RLE compression are exposed. The crafted input must cause the frame resolution to grow mid-stream so that processed frames become taller than the encoder height.

What level of attacker access is required?

The attacker does not need privileges, but exploitation requires local access and user interaction. They must be able to provide crafted media that is processed by the affected transcoding workflow.

How can I determine whether a deployment is affected?

Check whether the deployment uses FFmpeg through version 9.0.2 and whether it encodes to OpenEXR with RLE compression. Affected processing can write past the scanline array, corrupt heap memory, and crash the application.

CVE-2026-125260: FFmpeg through 9.0.2 Heap Buffer Overflow in EXR Encoder RLE Path

Affected Software

Event History

Frequently Asked Questions

Which workflows are exposed to this issue?

What level of attacker access is required?

How can I determine whether a deployment is affected?

Company

Resources

Contact

Frequently Asked Questions

Which workflows are exposed to this issue?

What level of attacker access is required?

How can I determine whether a deployment is affected?