MinorCritical vulnerability

CVE-2026-125212 (CVSS 7.3)

NVD · officialPublished Nov 9, 2026Risk 23/100

FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in libavcodec/videotoolboxenc.c that copies frames larger than encoder dimensions into undersized CVPixelBuffers. Attackers can supply crafted input whose resolution grows mid-stream, transcoded with VideoToolbox encoders without rescaling, to crash the application or corrupt memory.

Technical details

CVSS

7.3

AV:LocalAC:HighPR:NoneUI:Passive

Evidence and sources

This record is attributed to NVD. Exploitation status and remediation guidance are kept separate from the vulnerability's technical severity.

Open primary source