CVE-2026-125244

HIGH 7.8

FFmpeg before 8.1.3 and 9.x before 9.0.2 VVC Decoder Out-of-Bounds Write via sh_entry_points

CVSS Score

7.8

EPSS Score

0.0%

EPSS Percentile

0th

FFmpeg before 8.1.3 and 9.x before 9.0.2 contains an out-of-bounds write vulnerability in the VVC decoder's sh_entry_points() function in libavcodec/vvc/ps.c. Attackers can supply a crafted VVC (H.266) bitstream whose SPS/PPS tile and WPP layout produces excess entry points, overflowing entry_point_start_ctu and corrupting decoder memory.

CWE	CWE-787
Vendor	ffmpeg
Product	ffmpeg
Published	Nov 9, 2026

Stay Ahead of the Next One

Get instant alerts for ffmpeg ffmpeg

Be the first to know when new high vulnerabilities affecting ffmpeg ffmpeg are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

FFmpeg / FFmpeg

7.0 < 8.1.3 9.0 < 9.0.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

code.ffmpeg.org: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24537 github.com: https://github.com/FFmpeg/FFmpeg/commit/a809a784ec9ff9910161c6c9554a041941d6ccce github.com: https://github.com/FFmpeg/FFmpeg/blob/n9.0.1/libavcodec/vvc/ps.c#L1453 github.com: https://github.com/FFmpeg/FFmpeg vulncheck.com: https://www.vulncheck.com/advisories/ffmpeg-before-8.1.3-and-9-x-before-9.0.2-vvc-decoder-out-of-bounds-write-via-sh-entry-points

Credits

Umar Pathan (Umar0x) 🔍 Joshua Rogers (AISLE Research) Umar Pathan