CVE-2026-125210

FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in aribcaption trans text subtitle() in libavcodec/libaribcaption.c when decoding with sub type text. Attackers can supply a crafted ARIB STD-B24 caption stream with zero regions, causing a pointer write past a zero-sized sub->rects allocation and corrupting heap memory.