CVE-2026-125233
HIGH
MEDIUM
Priority: 0.01
BB Relevance:
42/100
Published: 2026-11-09
Modified: 2026-11-10
First seen: 2026-11-09
Status: active
Attack Surface
Low Complexity
No Auth
Conf. Impact
Integ. Impact
CVSS Vector Breakdown
AV:
Local
AC:
Low
PR:
None
UI:
Passive
S:
X
AT:
None
VC:
High
VI:
High
VA:
High
Description
FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in dvbsub_encode() in libavcodec/dvbsubenc.c that undercounts each CLUT segment header by two bytes. Attackers can supply a file with many bitmap subtitle rectangles that, when transcoded to the dvbsub encoder, writes past the output buffer and corrupts heap memory.