CVE Alert: CVE-2026-125213 – FFmpeg

FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in the PSD decoder in libavcodec/psd.c that allows attackers to corrupt heap memory on 32-bit builds by supplying a crafted PSD image. Attackers can choose dimensions and channel counts whose product exceeds 4 GB, truncating the av_malloc allocation size so decode_rle() writes attacker-controlled data past the buffer, causing crashes or possible code execution.

**Risk verdict:** This is a high-impact but constrained memory-corruption risk; no KEV or active SSVC exploitation status was supplied, so immediate exploitation urgency cannot be confirmed.

**Why this matters:** Successful exploitation could compromise the process handling a malicious image, potentially enabling code execution or service disruption. A likely attacker goal is to deliver a crafted file through a trusted workflow, such as design-asset intake or media processing. PoC and EPSS data are also absent, leaving exploit maturity and prevalence uncertain.

**Most likely attack path:** An attacker needs the file to be available locally and decoded; the attack is difficult and requires a specific condition, but does not require the attacker to hold privileges. User interaction is needed to trigger processing, which may happen indirectly through an application or automated pipeline. Impact is confined to the vulnerable process’s security context; the metrics do not indicate direct cross-system scope, though stolen credentials or accessible files could enable follow-on activity.

**Who is most exposed:** Prioritise 32-bit deployments that decode untrusted PSD files, particularly media-conversion services, design workflows and user endpoints with preview or thumbnail generation.

Alert on decoder crashes or abnormal restarts during PSD processing.

Review file-ingestion logs for unusually large dimensions or channel counts.

Correlate suspicious PSD processing with unexpected child processes or outbound connections.

Mitigation and prioritisation:

Identify 32-bit builds and applications embedding the affected decoder; confirm exposure with dependency inventories.

Apply the upstream fix promptly, following normal testing and change control.

Until patched, block or quarantine untrusted PSD inputs and disable PSD decoding where practical.

Reassess priority when KEV, SSVC, PoC or EPSS data becomes available.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.