CVE-2026-125211

FFmpeg through 9.0.2 contains an out-of-bounds read and invalid free vulnerability in aribcaption trans ass subtitle() in libavcodec/libaribcaption.c that frees subtitle rectangles using region count instead of num rects. Attackers can supply crafted ARIB captions whose later region exceeds the 8 KiB AVBPrint limit, triggering cleanup that frees out-of-bounds pointers and corrupts the heap.