PT-2026-141072

CVE-2026-125244

·

Published

2026-11-09

·

Updated

2026-11-09

Description by

CVSS 3.1
7.8
High
MetricsAV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
FFmpeg before 8.1.3 and 9.x before 9.0.2 contains an out-of-bounds write vulnerability in the VVC decoder's sh entry points() function in libavcodec/vvc/ps.c. Attackers can supply a crafted VVC (H.266) bitstream whose SPS/PPS tile and WPP layout produces excess entry points, overflowing entry point start ctu and corrupting decoder memory.
Exploitability
Fix
Impacts
Researchers
Vendors
Affected products
Weakness enumeration
CWE-787: Out-of-bounds Write
Related identifiers
CVE-2026-125244
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com