CVE Alert: CVE-2026-125210 – FFmpeg

FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in aribcaption_trans_text_subtitle() in libavcodec/libaribcaption.c when decoding with sub_type text. Attackers can supply a crafted ARIB STD-B24 caption stream with zero regions, causing a pointer write past a zero-sized sub->rects allocation and corrupting heap memory.

**Risk verdict:** High-impact memory corruption, but exploitation urgency cannot be confirmed: KEV, SSVC, PoC and EPSS indicators were not supplied.

**Why this matters:** Successful exploitation could compromise the confidentiality, integrity and availability of the process handling the media. A realistic goal is to crash a media service or application, or potentially execute code; code execution is not established by the supplied data. The missing exploitation indicators leave uncertainty whether attackers are actively using this issue.

**Most likely attack path:** An attacker provides a crafted subtitle-bearing media stream and relies on a user or automated workflow to open or process it with the vulnerable decoding path enabled. Local access and high attack complexity make opportunistic remote exploitation less likely, while no prior privileges are indicated. Scope is unchanged, so compromise is expected to affect the decoding process rather than automatically enable lateral movement.

**Who is most exposed:** Systems that ingest or transcode broadcast, recorded or user-uploaded media using FFmpeg are the main concern, including media platforms and production workflows.

Review decoder crashes and heap-corruption reports associated with subtitle processing.

Identify services and jobs that enable ARIB text subtitle decoding.

Preserve and inspect suspicious media files linked to crashes.

Mitigation and prioritisation:

Apply a patched FFmpeg build containing the upstream fix; prioritise exposed media-ingestion systems.

Until patched, disable or reject ARIB text subtitle decoding where operationally feasible.

Isolate media parsers, restrict their filesystem and network access, and run them with least privilege.

Test representative media workflows before rollout; monitor for regressions after changing decoder configuration.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.