CVE Alert: CVE-2026-125211 – FFmpeg

FFmpeg through 9.0.2 contains an out-of-bounds read and invalid free vulnerability in aribcaption_trans_ass_subtitle() in libavcodec/libaribcaption.c that frees subtitle rectangles using region_count instead of num_rects. Attackers can supply crafted ARIB captions whose later region exceeds the 8 KiB AVBPrint limit, triggering cleanup that frees out-of-bounds pointers and corrupts the heap.

**Risk verdict:** Elevated but conditional risk; no active-exploitation or exploitation-likelihood evidence was supplied, so prioritise exposure-based remediation rather than assume widespread exploitation.

**Why this matters:** Successful exploitation could compromise the integrity, confidentiality and availability of the process handling the media. A realistic goal is to crash or corrupt a media-processing service, or potentially execute code in its context; downstream impact depends on that process’s access and isolation.

**Most likely attack path:** An attacker must get a crafted caption-bearing media file processed locally, and the vulnerable parsing path must encounter the required conditions. The metrics indicate no prior privileges are needed, but exploitation is difficult and requires user interaction; scope is unchanged, so lateral movement is not implied, though an over-privileged host could increase impact.

**Who is most exposed:** Systems that ingest or transcode broadcast media, process user-submitted video, or enable ARIB caption handling are the clearest candidates. Actual exposure depends on build configuration and whether that caption path is reachable.

Review media-service logs for crashes or abnormal failures while processing caption-bearing files.

Correlate repeated processing failures with the same upload, source or user.

Check whether affected processes restart unexpectedly or generate memory-corruption diagnostics.

Inventory builds and workloads with ARIB caption support enabled.

Mitigation and prioritisation

Apply the upstream fix; confirm whether vendor or distribution builds have backported it.

Until patched, disable or avoid ARIB caption processing where operationally safe.

Restrict untrusted media ingestion and process files in isolated, least-privileged sandboxes.

Test representative caption workflows before deployment; monitor for regressions.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.