CVE-2026-125204 FFmpeg through 9.0.2 Heap Buffer Overflow in libwebp Encoder Conditional Replenishment

FFmpeg through 9.0.2 contains a heap buffer overflow in fflibwebpgetframe in libwebpenccommon.c that lets attackers corrupt memory when crthreshold is set. Attackers can supply crafted media that increases resolution mid-stream, causing memcpy to write pixel data past the stale reference frame an...

CVE-2026-125204

FFmpeg versions through 9.0.2 are susceptible to a heap buffer overflow in the ff_libwebp_get_frame() function located in libwebpenc_common.c. This vulnerability occurs when cr_threshold is set, allowing attackers to provide crafted media that increases resolution mid-stream. This triggers a memc...