UBUNTU-CVE-2026-125227: Buffer Overflow

Published Nov 10, 2026

Updated

FFmpeg through 9.0.2 contains an integer overflow in cbsjpegwritescan() in libavcodec/cbsjpeg.c that causes a heap buffer overflow on 32-bit builds. Attackers can supply a crafted MJPEG/JPEG stream with a scan of 512 MiB or more, processed by CBS bitstream filters like filterunits, to corrupt the heap or crash the application.

Affected Software

7 affected components

ubuntu/ffmpeg*

Event History

Nov 10, 2026

CVE Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which systems are exposed to this issue?

Only 32-bit builds are identified as affected. The vulnerable path is reached when a crafted MJPEG/JPEG stream is processed through CBS bitstream filters such as filter_units.

What must an attacker provide to trigger the overflow?

An attacker needs to supply a crafted MJPEG/JPEG stream containing a scan of at least 512 MiB. Exploitation also requires the application to process that stream using the affected CBS bitstream-filter path.

Is ordinary JPEG or MJPEG processing necessarily affected?

The available information specifically identifies processing by CBS bitstream filters, such as filter_units. It does not establish that every JPEG or MJPEG decoding or processing workflow reaches the vulnerable function.

What is the likely impact if the issue is triggered?

The integer overflow can produce a heap buffer overflow, which may corrupt heap memory or crash the application. The supplied severity data rates confidentiality, integrity, and availability impact as high.

UBUNTU-CVE-2026-125227: Buffer Overflow

Affected Software

Event History

Frequently Asked Questions

Which systems are exposed to this issue?

What must an attacker provide to trigger the overflow?

Is ordinary JPEG or MJPEG processing necessarily affected?

What is the likely impact if the issue is triggered?

Company

Resources

Contact

Frequently Asked Questions

Which systems are exposed to this issue?

What must an attacker provide to trigger the overflow?

Is ordinary JPEG or MJPEG processing necessarily affected?

What is the likely impact if the issue is triggered?