Dashboard / CVE-2026-125228

CVE-2026-125228

MEDIUM
MEDIUM Priority: 0.01 BB Relevance: 27/100
Published: 2026-11-09 Modified: 2026-11-10 First seen: 2026-11-09 Status: active

Attack Surface

No Auth

CVSS Vector Breakdown

AV: Local
AC: High
PR: None
UI: Passive
S: X
AT: Present
VC: Low
VI: None
VA: High

Description

FFmpeg before 8.1.3 and 9.x before 9.0.2 contains an out-of-bounds read vulnerability in put_vector() in libavcodec/vorbisenc.c when NaN samples leave the codebook entry at -1. Attackers can supply audio with NaN float samples to the native Vorbis encoder, causing heap reads before arrays that crash the application or leak adjacent heap memory into output.

Weakness Classification (1)

Affected Software (4)

VendorProductVersion
FFmpeg FFmpeg 0 < 8.1.3
FFmpeg FFmpeg 9.0 < 9.0.2
FFmpeg FFmpeg 0 < 8.1.3
FFmpeg FFmpeg 9.0 < 9.0.2

References & Advisories (5)

Bug Bounty Relevance

27 / 100
✓ No authentication

CVSS Score

5.8 / 10.0 v4.0
CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

0.12%
Raw Score 0.001220
Percentile 2.0%
Date 2026-11-13

EPSS Trend

2026-11-13
0.00122
2026-11-12
0.00122
2026-11-10
0.00122

Intelligence Sources

mitre ref →
nvd ref →

External Links