CVE-2026-125250High· 7.8▾ TwilightFFmpeg through 9.0.2 contains a heap buffer overflow in the GIF encoder's gif_image_write_image() in libavcodec/gif.c because shrunk_buf is sized from the first frame's linesize. Attackers can supply PAL8 video whose frame linesize grows…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 42.9 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
FFmpeg through 9.0.2 contains a heap buffer overflow in the GIF encoder's gif_image_write_image() in libavcodec/gif.c because shrunk_buf is sized from the first frame's linesize. Attackers can supply PAL8 video whose frame linesize grows mid-stream, causing remap_frame_to_palette() to write past shrunk_buf and corrupt the heap during GIF transcoding.
FFmpeg <= 9.0.2Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-125260High· 7.0FFmpeg through 9.0.2 Heap Buffer Overflow in EXR Encoder RLE Path
CVE-2026-125261Medium· 6.1FFmpeg through 9.0.2 SGI Encoder Out-of-Bounds Read via sgienc.c
CVE-2026-125196High· 7.0FFmpeg through 9.0.2 Heap Buffer Overflow via liboapv APV Encoder Wrapper
CVE-2026-125204High· 7.0FFmpeg through 9.0.2 Heap Buffer Overflow in libwebp Encoder Conditional Replenishment
CVE-2026-125214High· 7.0FFmpeg through 9.0.2 Heap Buffer Overflow in Blu-ray PCM Decoder
CVE-2026-125212High· 7.0FFmpeg through 9.0.2 Heap Buffer Overflow via VideoToolbox Encoder