UBUNTU-CVE-2026-125247: Integer Overflow
FFmpeg through 9.0.2 contains an integer overflow vulnerability in dngdecodetiles() that allows attackers to leak uninitialized memory via crafted DNG tile dimensions. Attackers can set TileWidth or TileLength near INTMAX so the tile loop never runs, outputting a frame exposing uninitialized or stale heap memory.
Affected Software
Event History
Frequently Asked Questions
What must an attacker provide to trigger the issue?
The attacker must cause FFmpeg to decode a crafted DNG image with TileWidth or TileLength values near INT_MAX. Exploitation requires user participation, as reflected by the UI:P vector.
What is exposed if exploitation succeeds?
A successful exploit can cause FFmpeg to output a frame containing uninitialized or stale heap memory. The reported impact is limited to confidentiality; integrity and availability impacts are listed as none.
Which FFmpeg versions are identified as affected?
The issue is reported in FFmpeg through version 9.0.2.