CVE-2026-125261

EUVD-2026-120211
FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in the SGI encoder's encode_frame() in libavcodec/sgienc.c, where unsigned size variables mis-handle negative linesize frames. Attackers can supply a video whose display matrix triggers autorotate vflip, so transcoding to SGI images reads pixel data far outside the frame and crashes the process.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
6.1 MEDIUM
LOCAL
LOW
NONE
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).
VendorProductVersionSource
ffmpegffmpeg
𝑥
≤ 9.0.2
CNA
Common Weakness Enumeration
References
https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25690
https://github.com/FFmpeg/FFmpeg
https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/sgienc.c#L208
https://github.com/FFmpeg/FFmpeg/commit/c6e5b6105aa13f6b0df2a646da608078cfe52d79
https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-sgi-encoder-out-of-bounds-read-via-sgienc-c