CVE-2026-125259

FFmpeg through 9.0.2 contains an integer overflow vulnerability in ff prores kostya encode init() that miscalculates frame size upper bound using 32-bit arithmetic for large frame dimensions. Attackers can supply a high-resolution video transcoded with the prores ks encoder, causing encode frame() to write slices past an undersized packet buffer and corrupt heap memory.