CVE-2026-125206
LOW
INFO
Priority: 0.00
BB Relevance:
19/100
Published: 2026-11-09
Modified: 2026-11-13
First seen: 2026-11-09
Status: active
Attack Surface
No Auth
CVSS Vector Breakdown
AV:
Local
AC:
High
PR:
None
UI:
Passive
S:
X
AT:
Present
VC:
Low
VI:
None
VA:
None
Description
FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in the prores_ks encoder's get_alpha_data() that reads before the blocks buffer for interlaced frames with odd heights. Attackers can supply video with alpha and odd height encoded to interlaced ProRes 4444, causing out-of-bounds memory to be encoded into the output alpha plane.