UBUNTU-CVE-2026-125250: Buffer Overflow
FFmpeg through 9.0.2 contains a heap buffer overflow in the GIF encoder's gifimagewriteimage() in libavcodec/gif.c because shrunkbuf is sized from the first frame's linesize. Attackers can supply PAL8 video whose frame linesize grows mid-stream, causing remapframetopalette() to write past shrunkbuf and corrupt the heap during GIF transcoding.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems that use the affected FFmpeg package to transcode attacker-supplied PAL8 video into GIF are exposed. The vulnerable code is in FFmpeg's GIF encoder.
What does an attacker need to exploit it?
An attacker needs to provide PAL8 video with a frame linesize that increases during the stream and have it processed through GIF transcoding. The supplied vector indicates no privileges are required, but user interaction is required.
What is the potential impact of successful exploitation?
The overflow can corrupt the heap during GIF transcoding. The provided severity vector rates confidentiality, integrity, and availability impact as high.
How can I determine whether my workflow is affected?
Review whether your FFmpeg deployment performs GIF output encoding on untrusted or externally supplied PAL8 video. The issue applies to FFmpeg through version 9.0.2.