FFmpeg up to 9.0.2 DNG Decoder dng_decode_tiles TileWidth/TileLength integer overflow

Summaryinfo

A vulnerability was found in FFmpeg up to 9.0.2 and classified as problematic. This issue affects the function dng_decode_tiles of the component DNG Decoder. Executing a manipulation of the argument TileWidth/TileLength can lead to integer overflow. This vulnerability is registered as CVE-2026-125247. It is possible to launch the attack remotely. No exploit is available.

Detailsinfo

A vulnerability classified as problematic was found in FFmpeg up to 9.0.2. This vulnerability affects the function dng_decode_tiles of the component DNG Decoder. The manipulation of the argument TileWidth/TileLength with an unknown input leads to a integer overflow vulnerability. The CWE definition for the vulnerability is CWE-190. The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number. As an impact it is known to affect confidentiality. CVE summarizes:

FFmpeg through 9.0.2 contains an integer overflow vulnerability in dng_decode_tiles() that allows attackers to leak uninitialized memory via crafted DNG tile dimensions. Attackers can set TileWidth or TileLength near INT_MAX so the tile loop never runs, outputting a frame exposing uninitialized or stale heap memory.

The advisory is shared for download at code.ffmpeg.org. This vulnerability was named CVE-2026-125247 since 11/09/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 11/09/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Multimedia Processing Software

Name

• FFmpeg

Version

• 9.0.0
• 9.0.1
• 9.0.2

License

• open-source

Website

• Product: https://ffmpeg.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion