Sources: National Vulnerability Database, CVE.org, CISA KEV, FIRST EPSS
CVE-2026-125213 Overview
FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in the PSD decoder in libavcodec/psd.c that allows attackers to corrupt heap memory on 32-bit builds by supplying a crafted PSD image. Attackers can choose dimensions and channel counts whose product exceeds 4 GB, truncating the av_malloc allocation size so decode_rle() writes attacker-controlled data past the buffer, causing crashes or possible code execution.
Critical Impact
Affected Products
- FFmpeg: see the vendor advisory for the exact affected versions
Discovery Timeline
- 2026-11-09: CVE-2026-125213 published to the National Vulnerability Database by disclosure@vulncheck.com
- 2026-11-09: last updated in the NVD database
Technical Details for CVE-2026-125213
Vulnerability Analysis
CVE-2026-125213 is a Security Vulnerability weakness (CWE-197) in FFmpeg. Based on its CVSS vector, the flaw needs local or adjacent access, needs no login, and relies on a user taking an action.
With a CVSS base score of 7.3, apply the vendor fix and confirm exposure on internet facing and business critical assets first.
Root Cause
The vendor description states: FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in the PSD decoder in libavcodec/psd.c that allows attackers to corrupt heap memory on 32-bit builds by supplying a crafted PSD image. Attackers can choose dimensions and channel counts whose product exceeds 4 GB, truncating the av_malloc allocation size so decode_rle() writes attacker-controlled data past the buffer, causing crashes or possible code execution.
Attack Vector
Based on the CVSS vector, the flaw needs local or adjacent access, needs no login, and relies on a user taking an action. Attack complexity is high complexity.
No exploitation in the wild is confirmed by CISA at the time of the last update. Check the references below for any vendor or researcher proof of concept.
CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Detection Methods for CVE-2026-125213
Detection Strategies
- Inventory every instance of FFmpeg and compare the running version with the affected range above.
- Check external attack surface scans for internet facing instances of the component.
- Run an authenticated vulnerability scan once your scanner ships a check for this CVE.
Monitoring Recommendations
- Forward FFmpeg application, access and audit logs to your SIEM for retrospective hunting.
- Alert on new processes, configuration changes or outbound connections from the affected service.
- Track the vendor advisory and the CISA KEV catalog for changes in exploitation status.
How to Mitigate CVE-2026-125213
Immediate Actions Required
- Apply the fixed version of FFmpeg named in the vendor advisory.
- Prioritize internet facing and business critical instances first.
- Rescan after the change to confirm the exposure is closed.
Patch Information
Use the fixed version listed in the vendor advisory for FFmpeg.
Workarounds
- If patching must wait, restrict network access to the affected service and place it behind authentication or a web application firewall rule.
CWE References
Technical References
This entry is built directly from NVD, CISA KEV and EPSS data. Verify fixed versions in the vendor advisory before you deploy.
Frequently asked questions
Related CVEs
A heap buffer overflow could occur in the DTLS 1.3 ACK serialization path before the connecting peer is authenticated. The buffer overflow was due to an integer truncation when computing the length of the ACK record-number list, causing an undersized buffer to be allocated and then overrun. This affects builds using DTLS 1.3 and wolfSSL version 5.9.0 and earlier. A fix was added to the 5.9.1 release.
Numeric truncation error in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
NLnet Labs Unbound 1.14.0 up to and including version 1.25.0 has a vulnerability that results in heap overflow when encoding multiple NSID and/or DNS Cookie EDNS and/or EDNS Padding options in the reply packet. The relevant options ('nsid', 'answer-cookie', 'pad-responses' (default)) need to be enabled for the vulnerability to be exploited. An adversary who can query Unbound can exploit the vulnerability by attaching multiple NSID and/or DNS Cookie EDNS and/or EDNS Padding options to the query. A flaw in the size calculation of the EDNS field truncates the correct value which allows the encoder to overflow the available space when writing. Those two combined lead to a heap overflow write of Unbound controlled data and eventually a crash. Unbound 1.25.1 contains a patch with a fix to de-duplicate the EDNS options and a fix to prevent truncation of the EDNS field size calculation.
Heap-based buffer overflow in Windows Spaceport.sys allows an authorized attacker to elevate privileges over a network.
Earn your free CTEM certification.
Learn to scope, prioritize, validate and mobilize fixes for CVEs like CVE-2026-125213 with a free CTEM certification.
Beginner / Practitioner / Program Leader
Explore certifications