EUVD-2026-120209

FFmpeg through 9.0.2 contains an integer overflow vulnerability in ffproreskostyaencodeinit that miscalculates framesizeupperbound using 32-bit arithmetic for large frame dimensions. Attackers can supply a high-resolution video transcoded with the proresks encoder, causing encodeframe to write...

CVE-2026-125259

FFmpeg versions through 9.0.2 are vulnerable to an integer overflow in the ff_prores_kostya_encode_init() function. The root cause is the use of 32-bit arithmetic to calculate frame_size_upper_bound for large frame dimensions, which results in an undersized packet buffer. An attacker providing hi...