MinorCritical vulnerability

CVE-2026-125257 (CVSS 7.3)

NVD · officialPublished Nov 9, 2026Risk 23/100

FFmpeg through 9.0.2 contains an off-by-one heap overflow vulnerability in get_exponent_dynamic() in libavcodec/nellymoserenc.c that allows writing one element past the opt and path allocations. Attackers can supply crafted audio to applications encoding Nellymoser with trellis enabled, causing idx to equal OPT_SIZE and overwrite adjacent heap memory.

Technical details

CVSS

7.3

AV:LocalAC:HighPR:NoneUI:Passive

Evidence and sources

This record is attributed to NVD. Exploitation status and remediation guidance are kept separate from the vulnerability's technical severity.

Open primary source