Bug 2569601 (CVE-2026-125180) - CVE-2026-125180 ffmpeg: FFmpeg: Denial of Service via memory exhaustion in EXIF parser
Summary: CVE-2026-125180 ffmpeg: FFmpeg: Denial of Service via memory exhaustion in EX...
Keywords:
Status: NEW
Alias: CVE-2026-125180
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-11-10 13:10 UTC by OSIDB Bzimport
Modified: 2026-11-10 13:48 UTC (History)
1 user (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-11-10 13:10:48 UTC 
FFmpeg 8.1 through 9.0.2 contains a memory exhaustion vulnerability in the libavcodec/exif.c parser that allows attackers to amplify allocations by pointing many IFD entries at overlapping payloads. Attackers can embed a small crafted EXIF block in TIFF, JPEG, PNG or WebP images to trigger quadratic memory allocation, causing denial of service in decoding applications.
Note You need to log in before you can comment on or make changes to this bug.