UBUNTU-CVE-2026-125214: Buffer Overflow

Published Nov 10, 2026

Updated

FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in pcmbluraydecodeframe() in libavcodec/pcm-bluray.c on big-endian hosts. Attackers can supply a crafted Blu-ray (M2TS) LPCM stream whose payload length is not a multiple of the sample size, writing attacker-controlled bytes past the audio frame buffer.

Affected Software

7 affected components

ubuntu/ffmpeg*

Event History

Nov 10, 2026

CVE Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which systems are exposed to this issue?

The vulnerable code path affects FFmpeg on big-endian hosts when decoding Blu-ray (M2TS) LPCM audio streams. Systems that do not process this media format or are not big-endian are not described as affected.

What does exploitation require?

An attacker must provide a crafted Blu-ray LPCM stream with a payload length that is not a multiple of the sample size, and the target must decode that stream. The supplied severity vector also indicates local attack conditions, high attack complexity, and user interaction.

What is the impact if exploitation succeeds?

The malformed stream can cause attacker-controlled bytes to be written past the audio frame buffer. The reported impact includes high confidentiality, integrity, and availability effects.

UBUNTU-CVE-2026-125214: Buffer Overflow

Affected Software

Event History

Frequently Asked Questions

Which systems are exposed to this issue?

What does exploitation require?

What is the impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

Which systems are exposed to this issue?

What does exploitation require?

What is the impact if exploitation succeeds?