# CVE-2026-125209

Heap overflow in FFmpeg dvdsub encoder enabling possible RCE when transcoding crafted subtitles

- Page: https://www.vulneraibility.com/cve/CVE-2026-125209
- CVSS: 8.5
- Known exploited: not in CISA KEV as of our last sync
- Weakness: CWE-131
- Published: 2026-11-09

## Affected versions

- FFmpeg: affected < 8.1.3; >= 9.0 and < 9.0.2

A version outside these ranges is not a statement that it is unaffected.

## Impact

Heap buffer overflow during dvdsub subtitle encoding; can crash processes or enable remote code execution via crafted bitmap subtitles.

## Action

Patch when possible

## Recommendation

Upgrade to FFmpeg 8.1.3 or 9.0.2; avoid processing untrusted subtitle files.

## References

- [other] https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24486
- [patch] https://github.com/FFmpeg/FFmpeg/commit/8702f12c9daa199cc4d7c17164b13c3cdcdc2436
- [other] https://github.com/FFmpeg/FFmpeg/blob/n9.0.1/libavcodec/dvdsubenc.c#L344
- [other] https://github.com/FFmpeg/FFmpeg
- [advisory] https://www.vulncheck.com/advisories/ffmpeg-before-8.1.3-and-9-x-before-9.0.2-heap-buffer-overflow-via-dvdsubenc-c

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.