GHSA-hgc4-q7h6-33wqMediumCVSS 5.5
FFmpeg 8.1 through 9.0.2 contains a memory exhaustion vulnerability in the libavcodec/exif.c...
🔗 CVE IDs covered (1)
📋 Description
FFmpeg 8.1 through 9.0.2 contains a memory exhaustion vulnerability in the libavcodec/exif.c parser that allows attackers to amplify allocations by pointing many IFD entries at overlapping payloads. Attackers can embed a small crafted EXIF block in TIFF, JPEG, PNG or WebP images to trigger quadratic memory allocation, causing denial of service in decoding applications.
🔗 References (7)
- https://nvd.nist.gov/vuln/detail/CVE-2026-125180
- https://github.com/FFmpeg/FFmpeg/commit/30fff47764e59f02ac7868bb832ed51a88f949fd
- https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25408
- https://github.com/FFmpeg/FFmpeg
- https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/exif.c#L274
- https://www.vulncheck.com/advisories/ffmpeg-8.1-through-9.0.2-exif-parser-memory-exhaustion-via-overlapping-tags
- https://github.com/advisories/GHSA-hgc4-q7h6-33wq