CVE-2026-125259FFmpeg FFmpeg Integer Overflow or Wraparound

NVD

Vulnerability Summary

FFmpeg through 9.0.2 contains an integer overflow vulnerability in ff_prores_kostya_encode_init() that miscalculates frame_size_upper_bound using 32-bit arithmetic for large frame dimensions. Attackers can supply a high-resolution video transcoded with the prores_ks encoder, causing encode_frame() to write slices past an undersized packet buffer and corrupt heap memory.

Severity Level

HIGH(8.5)

Published Date

Nov 9, 2026

Last Modified

Nov 10, 2026

Exploitation Status

No confirmed exploitation yet

EPSS Score (30-Day)

0.13%Probability

Root Weakness (CWE)

CWE-190: Integer Overflow or Wraparound ↗

The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes the resulting value will always be larger than the original.

CVSS v4.0 Base Metrics — Score 8.5 (HIGH)

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Attack VectorLocal

Attack ComplexityLow

Attack RequirementsNone

Privileges RequiredNone

User InteractionPassive

Confidentiality (Vulnerable System)High

Integrity (Vulnerable System)High

Availability (Vulnerable System)High

Confidentiality (Subsequent System)None

Integrity (Subsequent System)None

Availability (Subsequent System)None

Show CVSS v3.x metrics (score 7.8)

CVSS v3.1 Base Metrics — Score 7.8 (HIGH)

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack VectorLocal

Attack ComplexityLow

Privileges RequiredNone

User InteractionRequired

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

Affected & Patched Versions

Affected Versions

FFmpeg FFmpeg <= 9.0.2

Patched Versions

FFmpeg FFmpeg 9.0.2

What to do

Plan remediation soon. No exploitation is confirmed yet, but the severity is high.

Check whether you run FFmpeg FFmpeg and which version.
Update to a patched version listed above, then confirm the new version.

Timeline

Nov 9, 2026Published
Nov 10, 2026Record last modified

Score, severity and exploitation changes are tracked from the day Watchtower started logging them.

Get notified about new FFmpeg FFmpeg CVEsYou are reading CVE-2026-125259. Get an email when KEV listings, exploits or new CVEs match your stack.

Set up CVE alerts

External References

Data last checked: Nov 13, 2026 21:28 UTC