CVE Alert: CVE-2026-125214 – FFmpeg

FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in pcm_bluray_decode_frame() in libavcodec/pcm-bluray.c on big-endian hosts. Attackers can supply a crafted Blu-ray (M2TS) LPCM stream whose payload length is not a multiple of the sample size, writing attacker-controlled bytes past the audio frame buffer.

**Risk verdict:** Elevated but condition-dependent; no KEV, SSVC exploitation, PoC or EPSS data was supplied, so active exploitation and overall urgency remain uncertain.

**Why this matters:** A successful exploit could compromise the media-processing process, with potential for data exposure, tampering or service disruption. The practical risk is greatest where untrusted media is routinely ingested or processed automatically.

**Most likely attack path:** An attacker needs the crafted media to reach a vulnerable decoder on a big-endian host; high attack complexity and an additional host condition limit exposure. No elevated privileges are needed, but a user or process must trigger decoding; the stated unchanged scope gives no indication of impact crossing the affected process’s security boundary.

**Who is most exposed:** Prioritise media-ingest, transcoding and archival systems, plus appliances or specialist deployments using big-endian hardware. Ordinary installations on other architectures are not indicated as exposed by the supplied details.

Identify big-endian hosts and inventory media-processing components and linked decoder libraries.

Review ingest and transcoding logs for malformed Blu-ray/M2TS LPCM inputs and decoder errors.

Look for crashes or memory-corruption alerts in processes handling untrusted media.

Correlate suspicious media submissions with unexpected process behaviour or service restarts.

Mitigation and prioritisation

Apply the upstream fix promptly to confirmed exposed builds; verify the fix is present in packaged libraries.

Until patched, block or quarantine untrusted M2TS/LPCM input and disable this decoding path where feasible.

Prioritise internet-facing or third-party-fed media pipelines; test changes against representative workloads before broad rollout.

Reassess when exploitation intelligence and EPSS data become available.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.