CVE Alert: CVE-2026-125218 – FFmpeg

FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in the APNG encoder’s encode_apng() function in libavcodec/pngenc.c when frame size changes mid-stream. Attackers can supply crafted media whose resolution grows mid-stream, causing APNG_DISPOSE_OP_BACKGROUND memset writes past prev_frame and crashing or corrupting heap memory in transcoding applications.

**Risk verdict:** Risk is high where untrusted animated-image inputs are encoded; no KEV, SSVC exploitation, PoC, or EPSS data was supplied, so active exploitation and immediate fleet-wide urgency cannot be confirmed.

**Why this matters:** A successful attack could corrupt or crash the encoding process, disrupt media services, or potentially compromise data and system integrity available to that process. The most realistic attacker goal is to weaponise a file submitted to a conversion or publishing workflow, causing service disruption or gaining a foothold in a processing environment; reliable exploitation is not established by the information provided.

**Most likely attack path:** The attacker must get a crafted file processed by a system that performs the relevant encoding. The local attack requirement and high complexity suggest a specific processing condition is needed, but no privileges are required and user interaction may be limited to a person or service opening or converting the file. The stated unchanged scope suggests impact is primarily confined to the vulnerable process, though its accessible files, secrets, and connected services remain at risk.

**Who is most exposed:** Internet-facing media upload and transcoding pipelines, content platforms, editing services, and appliances that process user-supplied animated images are the main concern.

Alert on encoder worker crashes, restarts, or heap-corruption diagnostics.

Log animated-image inputs and flag frame-dimension changes during processing.

Review upload-to-transcode events preceding worker failures.

Mitigation and prioritisation:

Apply an upstream-fixed build; confirm downstream packages include the correction.

Until patched, disable the affected encoding path for untrusted inputs or restrict accepted formats.

Run conversion workers with least privilege and isolate them from sensitive data and internal services.

Test representative media workflows in staging before deployment; monitor worker stability afterwards.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.