# CVE-2026-125251: FFmpeg integer overflow in VVC decoder alloc_frame()

Source: https://junglewise.ai/threats/cve-2026-125251-ffmpeg-through-9-0-2-contains-an-integer-overflow-vulnerability  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-09. Updated: 2026-11-09  
License: CC BY 4.0 with a link back

CVE-2026-125251 · Severity: high · CVSS 7 · Published 2026-11-09

FFmpeg is a multimedia library used to encode, decode, and process video and audio. An integer overflow vulnerability in its VVC video decoder can cause heap memory corruption when processing specially crafted H.266 video files, potentially leading to crashes or arbitrary code execution during video playback.

Technologies: [Ffmpeg](https://junglewise.ai/threats/technologies/ffmpeg). Vendors: [Ffmpeg](https://junglewise.ai/threats/vendors/ffmpeg).

## Quick answers

**Is CVE-2026-125251 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-125251 being exploited in the wild.

**How severe is CVE-2026-125251?** High severity, with a CVSS score of 7, published 9 November 2026.

**Which products and versions are affected?** Ffmpeg through 9.0.2.

**Is there a fix for CVE-2026-125251?** Yes: fixed in FFmpeg 9.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-125251 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-125251?** Check whether you run Ffmpeg at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in FFmpeg 9.1

## Technical details

An integer overflow in the alloc_frame() function of libavcodec/vvc/refs.c causes the reference picture list allocation to be undersized on 32-bit builds when processing VVC (H.266) streams with a very large number of NAL units per access unit. This results in heap out-of-bounds writes and memory corruption. The vulnerability requires the attacker to supply a crafted VVC file; no authentication or user interaction beyond opening the file is required.

## Affected products

- FFmpeg FFmpeg through 9.0.2

## Timeline

- 2026-11-09: disclosed: CVE-2026-125251 published
- 2026-10-29: patched: Patch merged in PR #25572

## References

- [https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25572](https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25572)
- [https://github.com/FFmpeg/FFmpeg](https://github.com/FFmpeg/FFmpeg)

## Related threats

- [FFmpeg heap out-of-bounds read in v4l2_buffers](https://junglewise.ai/threats/cve-2026-125270-ffmpeg-through-9-0-2-contains-a-heap-out-of-bounds-read)
- [FFmpeg double free in H.264 SEI message handling](https://junglewise.ai/threats/cve-2026-125269-ffmpeg-through-9-0-2-contains-a-double-free-vulnerability-in)
- [FFmpeg heap out-of-bounds write in APAC decoder](https://junglewise.ai/threats/cve-2026-125267-ffmpeg-before-8-1-3-and-9-x-before-9-0-2-contains-a-heap-out-of)
- [FFmpeg use-after-free in NVIDIA codec decoding](https://junglewise.ai/threats/cve-2026-125265-ffmpeg-through-9-0-2-contains-a-use-after-free-vulnerability-in)
- [FFmpeg JPEG XL parser uncontrolled resource consumption](https://junglewise.ai/threats/cve-2026-125264-ffmpeg-through-9-0-2-contains-an-uncontrolled-resource)