FFmpeg through 9.0.2 Heap Buffer Overflow in Blu-ray PCM Decoder
Only FFmpeg through 9.0.2 on big-endian hosts is affected, when it decodes a crafted Blu-ray (M2TS) LPCM stream whose payload length is not a multiple of the sample size.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Exploited
- No known exploitation
- Fix
- Fix or patch referenced
- Who is exposed
- Specific setups only
Do first: Check whether your setup matches what the bug needs. Affects FFmpeg through 9.0.2 on big-endian hosts Crafted Blu-ray (M2TS) LPCM stream whose payload length is not a multiple of the sample size
- Last modified
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 12/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in pcm_bluray_decode_frame() in libavcodec/pcm-bluray.c on big-endian hosts. Attackers can supply a crafted Blu-ray (M2TS) LPCM stream whose payload length is not a multiple of the sample size, writing attacker-controlled bytes past the audio frame buffer.
cve.now Index
- Exploitation?/40Unknown. No CISA SSVC exploitation rating yet
- Exposure5/25Specific setups only
- Reach?/20Unknown. No tracked technology or package matched
- Severity7.3/10CVSS 7.3
- No patch0/5No signal
What would change the score
- Would score about 62 if added to CISA KEV
- Would score about 57 if CISA's SSVC rates exploitation active
- Would score about 22 if CISA's SSVC rates it automatable
What to do
Check whether your setup matches what the bug needs.
Affects FFmpeg through 9.0.2 on big-endian hosts Crafted Blu-ray (M2TS) LPCM stream whose payload length is not a multiple of the sample sizeApply the patch listed under Evidence.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- FFmpeg FFmpeg
through 9.0.2
Evidence 5
- Patch
- Report
- Repository
- Repository
- Link
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-125214
Is CVE-2026-125214 being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
What does this mean?
The Blu-ray PCM decoder writes past the end of its audio frame buffer when a crafted stream's payload length does not divide evenly by the sample size. This overflows the heap and writes attacker-controlled bytes into memory beyond the buffer.Source: vulncheck.com
Which versions are affected by CVE-2026-125214?
FFmpeg: through 9.0.2.Source: cve.now feed data
Am I affected, and how do I check?
The listed range is FFmpeg versions through 9.0.2, and the flaw is in the pcm_bluray_decode_frame() function in libavcodec/pcm-bluray.c on big-endian hosts. Check the version with ffmpeg -version and confirm the host's byte order from its architecture.Source: vulncheck.com
How do I fix CVE-2026-125214?
The checked facts name no fixed release, so no upgrade target can be given. Check the FFmpeg project's release notes or advisory for a patched version.Source: vulncheck.com