FFmpeg through 9.0.2 Heap Buffer Overflow in EXR Encoder RLE Path
FFmpeg through 9.0.2 is affected when frames taller than the encoder height are encoded to OpenEXR with RLE compression, as with input whose resolution grows mid-stream.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Exploited
- No known exploitation
- Fix
- Fix or patch referenced
- Who is exposed
- Specific setups only
Do first: Check whether your setup matches what the bug needs. FFmpeg through 9.0.2 Frames taller than the encoder height reach encode_scanline_rle() in the EXR encoder Input whose resolution grows mid-stream Output transcoded to OpenEXR with RLE compression
- Last modified
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 12/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
FFmpeg versions up to 9.0.2 have a heap buffer overflow in the OpenEXR encoder's RLE path. An attacker can exploit it locally, without logging in, by supplying crafted input whose resolution grows mid-stream and requires user action to process, which can corrupt heap memory and crash the application.
Read the original description
FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in libavcodec/exrenc.c that allows attackers to corrupt heap memory when encode_scanline_rle() processes frames taller than the encoder height. Attackers can supply crafted input whose resolution grows mid-stream, transcoded to OpenEXR with RLE compression, to write pointers past the scanline array and crash the application.
cve.now Index
- Exploitation?/40Unknown. No CISA SSVC exploitation rating yet
- Exposure5/25Specific setups only
- Reach?/20Unknown. No tracked technology or package matched
- Severity7.3/10CVSS 7.3
- No patch0/5No signal
What would change the score
- Would score about 62 if added to CISA KEV
- Would score about 57 if CISA's SSVC rates exploitation active
- Would score about 22 if CISA's SSVC rates it automatable
What to do
Check whether your setup matches what the bug needs.
FFmpeg through 9.0.2 Frames taller than the encoder height reach encode_scanline_rle() in the EXR encoder Input whose resolution grows mid-stream Output transcoded to OpenEXR with RLE compressionApply the patch listed under Evidence.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- FFmpeg FFmpeg
through 9.0.2
Evidence 5
- Patch
- Report
- Repository
- Repository
- Link
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-125260
Is CVE-2026-125260 being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
What does this mean?
When frames taller than the encoder height reach the EXR encoder's RLE path, FFmpeg writes pointers past the scanline array. This corrupts heap memory and can crash the application.Source: vulncheck.com
Which versions are affected by CVE-2026-125260?
FFmpeg: through 9.0.2.Source: cve.now feed data
Am I affected, and how do I check?
FFmpeg versions through 9.0.2 are in scope. The bug needs OpenEXR output with RLE compression and input whose resolution grows mid-stream. Check the installed version with `ffmpeg -version` and review the encoder and compression settings used in your commands or scripts.Source: vulncheck.com
How do I fix CVE-2026-125260?
The sources provided do not name a fixed version, so no specific upgrade target is confirmed. Check the FFmpeg project for a release newer than 9.0.2 that addresses this issue.Source: vulncheck.com