Is CVE-2026-125261 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-125261 being exploited in the wild.

How severe is CVE-2026-125261?

Medium severity, with a CVSS score of 6.1, published 9 November 2026.

Is there a fix for CVE-2026-125261?

Yes: fixed in FFmpeg 9.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-125261 attacked?

It is attacked over the network or with local access, in a software library.

Am I affected by CVE-2026-125261?

Check whether you run Ffmpeg at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-125261: FFmpeg SGI encoder out-of-bounds read in encode_frame()

CVE-2026-125261 · Severity: medium · CVSS 6.1 · Published 2026-11-09

FFmpeg is multimedia processing software widely used to transcode and convert video formats. An out-of-bounds read vulnerability in the SGI image encoder can crash the transcoding process when processing videos with rotation metadata. An attacker can supply a malicious video file that, when converted to SGI format, triggers an application crash leading to denial of service.

Technologies: Ffmpeg. Vendors: Ffmpeg.

Quick answers

Is CVE-2026-125261 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-125261 being exploited in the wild.
How severe is CVE-2026-125261?: Medium severity, with a CVSS score of 6.1, published 9 November 2026.
Which products and versions are affected?: Ffmpeg through 9.0.2.
Is there a fix for CVE-2026-125261?: Yes: fixed in FFmpeg 9.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-125261 attacked?: It is attacked over the network or with local access, in a software library.
Am I affected by CVE-2026-125261?: Check whether you run Ffmpeg at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: FFmpeg 9.1

Technical details

The SGI encoder's encode_frame() function in libavcodec/sgienc.c fails to properly handle negative linesize (stride) values that result from automatic vflip rotation applied via a video's display matrix. Unsigned size variables incorrectly process these negative strides, causing reads far outside allocated frame buffers. The vulnerability is triggered during transcoding of specially crafted video files and requires no authentication or user interaction beyond processing the file.

Affected products

FFmpeg FFmpeg through 9.0.2

Timeline

2026-11-09: disclosed
2026-11-03: patched: PR #25690 merged fixing SGI encoder stride handling

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.