CVE-2026-125194
Received Received - Intake

Out-of-Bounds Read in FFmpeg Audio Encoding

Publication date: 2026-11-09

Last updated on: 2026-11-09

Assigner: VulnCheck

Description
FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in pcm_dvd_encode_frame() in libavcodec/pcm-dvdenc.c when a 24-bit final frame holds fewer samples than one block. Attackers can supply 24-bit 48 or 96 kHz audio whose length leaves a short final frame, causing the loop counter to wrap and crash the transcoding process.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-09
Last Modified
2026-11-09
Generated
2026-11-09
AI Q&A
2026-11-09
EPSS Evaluated
N/A
NVD
CVE-2026-125194
EUVD
EUVD-2026-120283

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
FFmpeg FFmpeg From 0 (inc) to 9.0.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

FFmpeg through version 9.0.2 has an out-of-bounds read flaw in the pcm_dvd_encode_frame() function within libavcodec/pcm-dvdenc.c. This occurs when a 24-bit audio frame at the end of a stream has fewer samples than required for a full block. The loop counter wraps around due to the short frame, causing the transcoding process to crash.

Detection Guidance

This vulnerability can be detected by checking the FFmpeg version in use. Run 'ffmpeg -version' to verify if your version is 9.0.2 or earlier. If so, the system is potentially vulnerable. Additionally, monitor for crashes during audio transcoding, especially with 24-bit 48 or 96 kHz audio files.

Impact Analysis

This vulnerability can crash FFmpeg during audio transcoding, leading to denial-of-service conditions. Attackers could exploit it by providing maliciously crafted 24-bit audio files, disrupting media processing workflows or applications relying on FFmpeg.

Mitigation Strategies

Immediately update FFmpeg to the latest version beyond 9.0.2. If updating is not possible, avoid processing 24-bit audio files with 48 or 96 kHz sample rates until patched. Implement input validation to reject malformed audio files.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-125194. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...