CVE Alert: CVE-2026-125204 – FFmpeg

FFmpeg through 9.0.2 contains a heap buffer overflow in ff_libwebp_get_frame() in libwebpenc_common.c that lets attackers corrupt memory when cr_threshold is set. Attackers can supply crafted media that increases resolution mid-stream, causing memcpy() to write pixel data past the stale reference frame and crash applications.

**Risk verdict:** High-impact memory corruption warrants prompt remediation, although exploitation requires a demanding, user-mediated local processing path; KEV, SSVC, PoC and EPSS data were not supplied, so active exploitation urgency cannot be confirmed.

**Why this matters:** Successful exploitation could compromise the media-processing process, affecting confidentiality, integrity and availability; a crash or service interruption may be the more realistic outcome. Attackers would need to get crafted media processed, potentially targeting a worker that handles customer uploads or disrupting media workflows.

**Most likely attack path:** The vulnerable operation is local, with high attack complexity and an additional required condition; no elevated privileges are needed, but a user or workflow must process attacker-controlled content. The interaction is passive once processing starts, and the stated scope indicates no automatic impact beyond the affected process.

**Who is most exposed:** Prioritise systems that encode WebP through FFmpeg, especially upload/transcoding services, batch media pipelines and desktop tools that process untrusted files.

Look for crashes or restarts in FFmpeg workers during WebP encoding.

Correlate encoder activity with unusual resolution changes in a single input stream.

Review upload and job records for files processed immediately before worker failures.

In testing, use memory-safety instrumentation to identify out-of-bounds writes.

Mitigation and prioritisation

Apply the upstream fix; confirm the deployed build includes it, as fixed-version guidance is not provided here.

Until patched, disable the affected encoding path or avoid processing untrusted media.

Isolate workers, restrict file access and resource consumption, and enable automatic recovery.

Test representative media and monitor error rates before staged production rollout.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.