CVE-2026-125261
Received Received - Intake

Out-of-Bounds Read in FFmpeg SGI Encoder

Publication date: 2026-11-09

Last updated on: 2026-11-09

Assigner: VulnCheck

Description
FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in the SGI encoder's encode_frame() in libavcodec/sgienc.c, where unsigned size variables mis-handle negative linesize frames. Attackers can supply a video whose display matrix triggers autorotate vflip, so transcoding to SGI images reads pixel data far outside the frame and crashes the process.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-09
Last Modified
2026-11-09
Generated
2026-11-10
AI Q&A
2026-11-09
EPSS Evaluated
N/A
NVD
CVE-2026-125261
EUVD
EUVD-2026-120211

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
FFmpeg FFmpeg From 0 (inc) to 9.0.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an out-of-bounds read flaw in FFmpeg versions up to 9.0.2. It occurs in the SGI encoder's encode_frame() function where unsigned size variables fail to handle negative linesize frames correctly. Attackers can exploit this by providing a video with a display matrix that triggers autorotate vflip, causing the process to read pixel data outside the frame and crash.

Detection Guidance

Detecting this vulnerability requires checking for vulnerable FFmpeg versions. Use 'ffmpeg -version' to identify the installed version. If it is 9.0.2 or earlier, the system is potentially vulnerable. Additionally, monitor for crashes during video transcoding to SGI format.

Impact Analysis

This vulnerability could allow attackers to crash FFmpeg processes by supplying specially crafted video files. If exploited, it may lead to denial-of-service conditions, disrupting media processing tasks or services relying on FFmpeg for transcoding or encoding.

Compliance Impact

This vulnerability primarily causes crashes due to out-of-bounds reads, which may lead to denial-of-service conditions. It does not directly expose or leak sensitive data, so its impact on GDPR or HIPAA compliance is likely minimal unless the crashes disrupt critical processing of personal or health data.

Mitigation Strategies

Immediately update FFmpeg to the latest version beyond 9.0.2. If updating is not possible, avoid transcoding videos to SGI format or disable autorotate/vflip features in FFmpeg configurations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-125261. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...