CVE-2026-125204

FFmpeg through 9.0.2 contains a heap buffer overflow in ff libwebp get frame() in libwebpenc common.c that lets attackers corrupt memory when cr threshold is set. Attackers can supply crafted media that increases resolution mid-stream, causing memcpy() to write pixel data past the stale reference frame and crash applications.