CVE-2026-125260
FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in libavcodec/exrenc.c that allows attackers to corrupt heap memory when encode_scanline_rle() processes frames taller than the encoder height. Attackers can supply crafted input whose resolution grows mid-stream, transcoded to OpenEXR with RLE compression, to write pointers past the scanline array and crash the application.
- Score
- 7.3 high
- Published
- 2026-11-09
- Links
- NVD · cve.org · Report wrong data
Matched ports (5)
| Port | Package | Version | Status | Maintainer |
|---|---|---|---|---|
| multimedia/ffmpeg | ffmpeg | 9.0.2_3,1 | unaddressed | multimedia@FreeBSD.org |
| multimedia/ffmpeg | ffmpeg-nox11 | 9.0.2_3,1 | unaddressed | multimedia@FreeBSD.org |
| multimedia/ffmpeg3 | ffmpeg3 | 3.0.2_1 | unaddressed | kreinholz@gmail.com |
| multimedia/ffmpeg4 | ffmpeg4 | 4.4.8_2 | unaddressed | monwarez@mailoo.org |
| multimedia/linux-rl9-ffmpeg | linux-rl9-ffmpeg-libs | 7.1.5 | possibly backported | emulation@FreeBSD.org |
Template for a VuXML entry
Check the version numbers before you commit this entry. Some ports share an entry in the CVE database with another port, such as sqlite2 and sqlite3. The version shown here may then be one that never existed for this port.
Ranges per package from the CVE rows that match this port, in pkg notation with the port's epoch and revision, every bound checked with pkg; one range per epoch the port actually had. make newentry in security/vuxml creates the vid.
<vuln vid="FIXME (make newentry)">
<topic>ffmpeg -- FIXME</topic>
<affects>
<package>
<name>ffmpeg</name>
<name>ffmpeg-nox11</name>
<range><le>9.0.2_3,1</le></range>
</package>
<package>
<name>ffmpeg3</name>
<name>ffmpeg4</name>
<range><le>9.0.2</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>CVE-2026-125260: FFmpeg through 9.0.2 contains a heap buffer overflow
vulnerability in libavcodec/exrenc.c that allows attackers to
corrupt heap memory when encode_scanline_rle() processes frames
taller than the encoder height. Attackers can supply crafted input
whose resolution grows mid-stream, transcoded to OpenEXR with RLE
compression, to write pointers past the scanline array and crash
the application.</p>
</body>
</description>
<references>
<cvename>CVE-2026-125260</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2026-125260</url>
</references>
<dates>
<discovery>2026-11-09</discovery>
<entry>2026-11-10</entry>
</dates>
</vuln>