CVE-2026-125188
LOW
INFO
Priority: 0.00
BB Relevance:
19/100
Published: 2026-11-09
Modified: 2026-11-10
First seen: 2026-11-09
Status: active
Attack Surface
No Auth
CVSS Vector Breakdown
AV:
Local
AC:
High
PR:
None
UI:
Passive
S:
X
AT:
Present
VC:
Low
VI:
None
VA:
None
Description
FFmpeg through 9.0.2 contains a heap out-of-bounds read vulnerability in libavcodec/proresenc_anatoliy.c that occurs when the prores_aw encoder processes interlaced, odd-height frames. Attackers can supply odd-height video that causes subimage_with_fill_template() to fill padding rows from memory before the fill_y buffer, leaking heap contents into the encoded output.