UBUNTU-CVE-2026-125233: Buffer Overflow
FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in dvbsubencode() in libavcodec/dvbsubenc.c that undercounts each CLUT segment header by two bytes. Attackers can supply a file with many bitmap subtitle rectangles that, when transcoded to the dvbsub encoder, writes past the output buffer and corrupts heap memory.
Affected Software
Event History
Frequently Asked Questions
What conditions are required for exploitation?
An attacker must provide a file containing many bitmap subtitle rectangles and cause it to be transcoded using the DVB subtitle encoder. The vulnerable code path is in dvbsub_encode(), so processing files without transcoding to that encoder is not described as affected.
Who is most likely exposed?
Systems or workflows that use FFmpeg to transcode attacker-controlled or untrusted media into DVB subtitles are most exposed. The supplied severity vector indicates local attack vector and user interaction is required.
What is the potential impact if exploited?
The encoder can write past its output buffer and corrupt heap memory. The provided severity data rates confidentiality, integrity, and availability impact as high.
How can I identify potentially affected deployments?
Identify Ubuntu systems using FFmpeg and determine whether they transcode media with bitmap subtitle rectangles through the DVB subtitle encoder. The affected FFmpeg range stated in the advisory is through version 9.0.2.