# CVE-2026-125233

Heap overflow in FFmpeg DVB subtitle encoder enabling possible RCE during transcoding

- Page: https://www.vulneraibility.com/cve/CVE-2026-125233
- CVSS: 8.5
- Known exploited: not in CISA KEV as of our last sync
- Weakness: CWE-131
- Published: 2026-11-09

## Affected versions

- FFmpeg: affected <= 9.0.2

A version outside these ranges is not a statement that it is unaffected.

## Impact

Heap buffer overflow when encoding DVB subtitles allowing heap corruption and potential remote code execution from crafted media files.

## Action

Patch when possible

## Recommendation

Upgrade FFmpeg to the patched commit/release and avoid processing untrusted media; sandbox transcoding.

## References

- [other] https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24913
- [patch] https://github.com/FFmpeg/FFmpeg/commit/7f80b2ad83f37a4998d9617495c92b28a7339a90
- [other] https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/dvbsubenc.c#L363
- [other] https://github.com/FFmpeg/FFmpeg
- [advisory] https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-heap-buffer-overflow-via-dvb-subtitle-encoder

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.