UBUNTU-CVE-2026-125253: Integer Overflow
FFmpeg through 9.0.2 contains an integer overflow in cbsvp9splitfragment() in libavcodec/cbsvp9.c that wraps the superframe size check on 32-bit builds. Attackers can supply a crafted VP9 packet with a forged superframe index containing near-2^32 frame sizes, causing out-of-bounds reads that crash 32-bit applications.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
The issue affects 32-bit applications using FFmpeg through 9.0.2. The vulnerable code is reached when processing VP9 packets with a superframe index.
What does an attacker need to exploit it?
An attacker needs to provide a crafted VP9 packet containing a forged superframe index with frame sizes near 2^32. The published vector indicates local access, high attack complexity, and user interaction are required; no privileges are required.
What is the likely impact?
Successful exploitation causes out-of-bounds reads that can crash affected 32-bit applications. The provided impact metrics indicate low confidentiality impact, no integrity impact, and high availability impact.