MinorCritical vulnerability

CVE-2026-125214 (CVSS 7.3)

NVD · officialPublished Nov 9, 2026Risk 23/100

FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in pcm_bluray_decode_frame() in libavcodec/pcm-bluray.c on big-endian hosts. Attackers can supply a crafted Blu-ray (M2TS) LPCM stream whose payload length is not a multiple of the sample size, writing attacker-controlled bytes past the audio frame buffer.

Technical details

CVSS

7.3

AV:LocalAC:HighPR:NoneUI:Passive

Evidence and sources

This record is attributed to NVD. Exploitation status and remediation guidance are kept separate from the vulnerability's technical severity.

Open primary source