Applications

CVE-2026-125233

Heap overflow in FFmpeg DVB subtitle encoder enabling possible RCE during transcoding

Major vulnerability. FFmpeg is a widely used multimedia library; a high-severity heap overflow in its encoder can enable RCE in many apps and services that transcode or play media.

CVSS: 8.5Highscored by the publisher (CNA)
Exploited in the wild: Not knownnot in CISA KEV as of our last sync
EPSS: No score yet
Fix: Patch availablesee the advisories in the references
Published: 9 Nov 2026analysed here 12 Nov 2026

Summary

Impact

Heap buffer overflow when encoding DVB subtitles allowing heap corruption and potential remote code execution from crafted media files.

Triage

Exploitable: At runtime
Attack vector: local
Weakness: CWE-131 Common Weakness
Can a WAF block it?: No. See why

The summary, impact and action text on this page are written by our AI analysis pipeline, or taken from the NVD description when a CVE was imported from NVD. They are not the vendor's wording: check them against the sources. A longer AI executive summary and technical analysis are generated for signed-in accounts on the Max plan.

Affected products

Product	Affected versions	Vendor says fixed in
FFmpeg	<= 9.0.2Vendor says fixed in: not stated	Not stated by the vendor

As published in the CVE Program record. A version outside these ranges is not a statement that it is unaffected — vendors sometimes understate a range, and distribution-backported builds carry upstream numbers that do not reflect what was patched into them.

Products named in our analysis

FFmpeg <= 9.0.2
Applications embedding FFmpeg (media players, transcoders)
Media servers, streaming platforms, editors using FFmpeg

Fix and mitigation

Action required

Patch when possible

WAF and other mitigations

Can a WAF block it? No. The attack needs local access to the machine, so a WAF is not on its path.

Also consider: patch

Based on the attack vector (local or physical access). We check Cloudflare, AWS, Google Cloud Armor and Azure; for Akamai, Imperva, Fastly, F5, ask your vendor.

Remediation steps (AI-written)

Step-by-step remediation is generated for accounts on the Max plan, for CVEs that match a technology in their stack. Add this technology to your stack to see the fix checklist.

Exploitation evidence

CISA KEV catalog: Not listed as of our last sync.
Public exploit code: None on record in Exploit-DB, Metasploit, Nuclei templates or PoC-in-GitHub.

Timeline

9 Nov 2026Published
9 Nov 2026CVE record last updatedsame day later
12 Nov 2026Analysed by vulneraibility.com3 days later

Common questions

Is CVE-2026-125233 being exploited?

Not confirmed. CVE-2026-125233 does not appear in CISA's Known Exploited Vulnerabilities catalog, which records only exploitation that has been observed and reported publicly. That is evidence of absence of a report, not evidence the flaw is unattacked.

How severe is CVE-2026-125233?

CVE-2026-125233 is rated High with a CVSS score of 8.5. Severity describes how bad exploitation would be, not how likely it is: pair it with exploitation evidence before deciding what to patch first.

Is there a patch for CVE-2026-125233?

Yes. A fix has been recorded for CVE-2026-125233. The vendor advisory is the authority on the exact fixed version — apply it from there rather than from a summary.

What does CVE-2026-125233 affect?

CVE-2026-125233 affects FFmpeg <= 9.0.2, Applications embedding FFmpeg (media players, transcoders), Media servers, streaming platforms, editors using FFmpeg. Confirm the exact affected versions against the vendor advisory before deciding you are exposed.

What should I do about CVE-2026-125233?

Upgrade FFmpeg to the patched commit/release and avoid processing untrusted media; sandbox transcoding.

Exploitation status reflects CISA's KEV catalog as we last synced it. Check the catalog directly.

References

NVD CVE.org CVE Details Source

5 references in the CVE record, grouped by the tags the record gives them.

Advisories (1)

vulncheck.com /advisories/ffmpeg-through-9.0.2-heap-buffer-overflow-via-dvb-subtitle-encoder

Patches (1)

github.com /FFmpeg/FFmpeg/commit/7f80b2ad83f37a4998d9617495c92b28a7339a90

Where the data on this page comes from

CVE List (CVE.org): description, affected versions, references; CVE Terms of Use
NVD: CVSS and CPE data
FIRST EPSS: exploit probability and percentile

Summary, impact and triage tags: written by our AI analysis pipeline from the sources above. Check them against the sources.

Similar CVEs

Get CVEs like this by email. Join the free digest: the CVEs we flag as major, all CVSS 8.0 or higher, in up to three emails a day (sent at 05:00, 11:00 and 15:00 UTC). Matching alerts to the products you run needs an account, and accounts are invite-only during the beta.