Medium severity5.5NVD Advisory· Published Nov 9, 2026

CVE-2026-125180

Description

FFmpeg 8.1 through 9.0.2 contains a memory exhaustion vulnerability in the libavcodec/exif.c parser that allows attackers to amplify allocations by pointing many IFD entries at overlapping payloads. Attackers can embed a small crafted EXIF block in TIFF, JPEG, PNG or WebP images to trigger quadratic memory allocation, causing denial of service in decoding applications.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

FFmpeg/Ffmpegllm-fuzzy
Range: 8.1 - 9.0.2

Patches

Vulnerability mechanics

References

code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25408nvd
github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/exif.cnvd
github.com/FFmpeg/FFmpeg/commit/30fff47764e59f02ac7868bb832ed51a88f949fdnvd
www.vulncheck.com/advisories/ffmpeg-8.1-through-9.0.2-exif-parser-memory-exhaustion-via-overlapping-tagsnvd

News mentions

No linked articles in our index yet.

cvss	0.358
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000