CVE Alert: CVE-2026-125209 – FFmpeg

FFmpeg before 8.1.3 and 9.x before 9.0.2 contains a heap buffer overflow vulnerability in the DVD subtitle encoder that underestimates RLE output size for odd-width rectangles. Attackers can supply files with crafted bitmap subtitles that, when transcoded to the dvdsub encoder, write past the output buffer and corrupt heap memory.

**Risk verdict:** Prioritise remediation on systems that transcode untrusted media; active exploitation cannot be confirmed because KEV, SSVC, PoC and EPSS data were not provided.

**Why this matters:** A successful attack could corrupt memory and potentially compromise the FFmpeg process, affecting confidentiality, integrity and availability on the host. Realistic goals include disrupting media-processing services or gaining a foothold under the service account.

**Most likely attack path:** An attacker supplies a crafted media file containing bitmap subtitles, and a user or automated workflow processes it with the affected DVD subtitle encoder. The local attack vector and required user interaction make direct remote exploitation less likely; low complexity and no required privileges lower the barrier once processing occurs. Scope is unchanged, so lateral movement is not intrinsic, though compromised host access could enable it.

**Who is most exposed:** Media platforms, transcoding pipelines, editing systems and services that accept user-uploaded or externally sourced files are the main concerns.

Review FFmpeg job logs for DVD subtitle encoding of untrusted inputs.

Investigate crashes, allocator errors or unexpected restarts in media workers.

Correlate suspicious uploads with encoder errors and unusual child processes.

Mitigation and prioritisation:

Upgrade to a vendor-fixed build; expedite deployment on exposed processing services.

Until patched, disable the affected encoder or reject bitmap-subtitle inputs where feasible.

Isolate workers, restrict file and network access, and run with least privilege.

Confirm KEV, SSVC and EPSS status before finalising urgency; these data are absent here.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.