Medium severity5.3NVD Advisory· Published Nov 9, 2026

CVE-2026-125228

Description

FFmpeg before 8.1.3 and 9.x before 9.0.2 contains an out-of-bounds read vulnerability in put_vector() in libavcodec/vorbisenc.c when NaN samples leave the codebook entry at -1. Attackers can supply audio with NaN float samples to the native Vorbis encoder, causing heap reads before arrays that crash the application or leak adjacent heap memory into output.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

FFmpeg/Ffmpegllm-fuzzy
Range: <8.1.3 and <9.0.2

Patches

Vulnerability mechanics

References

code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24392nvd
github.com/FFmpeg/FFmpeg/blob/n9.0.1/libavcodec/vorbisenc.cnvd
github.com/FFmpeg/FFmpeg/commit/e33548ad13fd3495466a651792e8206b1c6f7fd7nvd
www.vulncheck.com/advisories/ffmpeg-before-8.1.3-and-9-x-before-9.0.2-out-of-bounds-read-in-vorbis-encodernvd

News mentions

No linked articles in our index yet.

cvss	0.345
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000