CVE-2026-125228

medium

Description

FFmpeg before 8.1.3 and 9.x before 9.0.2 contains an out-of-bounds read vulnerability in put_vector() in libavcodec/vorbisenc.c when NaN samples leave the codebook entry at -1. Attackers can supply audio with NaN float samples to the native Vorbis encoder, causing heap reads before arrays that crash the application or leak adjacent heap memory into output.

References

https://www.vulncheck.com/advisories/ffmpeg-before-8.1.3-and-9-x-before-9.0.2-out-of-bounds-read-in-vorbis-encoder

https://github.com/FFmpeg/FFmpeg/commit/e33548ad13fd3495466a651792e8206b1c6f7fd7

https://github.com/FFmpeg/FFmpeg/blob/n9.0.1/libavcodec/vorbisenc.c#L915

https://github.com/FFmpeg/FFmpeg

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-120178

https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24392

Details

Source: Mitre, NVD

Published: 2026-11-09

Updated: 2026-11-10

Risk Information

CVSS v2

Base Score: 4.7

Vector: CVSS2#AV:L/AC:H/Au:N/C:P/I:N/A:C

Severity: Medium

CVSS v3

Base Score: 5.3

Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:H

Severity: Medium

CVSS v4

Base Score: 5.8

Vector: CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N

Severity: Medium

EPSS

EPSS: 0.00122