CVE-2026-125237
FFmpeg 8.1 through 9.0.2 contains a denial of service vulnerability in libavcodec/dpx.c that leaves dpx->hwaccel_picture_private allocated w
CVSS
4.7
Medium
EPSS
0.2%
p5
KEV
—
Exploit Today
1
0-100
Published: Nov 9, 2026 · Last modified: Nov 9, 2026 · CWE-617
Not enough EPSS history yet.
FFmpeg 8.1 through 9.0.2 contains a denial of service vulnerability in libavcodec/dpx.c that leaves dpx->hwaccel_picture_private allocated when Vulkan hwaccel callbacks fail. Attackers can supply crafted DPX images that make start_frame, decode_slice or end_frame fail, triggering an av_assert0 abort on the next frame and terminating the decoding application.
- code.ffmpeg.orghttps://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25136
- github.comhttps://github.com/FFmpeg/FFmpeg
- github.comhttps://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/dpx.c#L786
- www.vulncheck.comhttps://www.vulncheck.com/advisories/ffmpeg-8.1-through-9.0.2-denial-of-service-via-dpx-vulkan-hwaccel-error-path
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-1209805.3 MED—
——0On affected platforms running Arista EOS with VPLS-BGP enabled, an attacker who has established a BGP session with the PE routers can send a specially crafted BGP packet to cause the BGP agent to restart unexpectedly.5hCVE-2026-1252464.7 MED4.8%
——1FFmpeg through 9.0.2 contains a denial of service vulnerability in cbs_jpeg_assemble_fragment() that miscounts 0xff stuffing bytes in JPEG scan headers. Attackers can supply a crafted JPEG/MJPEG stream with 0xff in the scan header, triggering an av_assert0 abort when CBS-based bitstream filters process it.1dCVE-2026-1252385.5 MED5.8%
——2FFmpeg through 9.0.2 contains a reachable assertion vulnerability in libxevd_receive_frame() in libavcodec/libxevd.c that returns success when an access unit produces no frame. Attackers can supply a crafted EVC file with truncated or picture-less access units to trigger the av_assert0() on frame->private_ref, aborting any decoding application.1dCVE-2026-1251894.7 MED4.7%
——1FFmpeg 8.1 through 9.0.2 contains a denial of service vulnerability in the lcevc_metadata bitstream filter caused by a process block position mismatch in lcevc_metadata_handle_vui(). Attackers can supply crafted LCEVC access units with two IDR or non-IDR NAL units to trigger an av_assert0 failure in ff_cbs_lcevc_list_add(), aborting the application.1dCVE-2026-1251875.5 MED5.7%
——2FFmpeg through 9.0.2 contains a reachable assertion vulnerability in the TTA encoder's tta_encode_frame() in libavcodec/ttaenc.c, which never reserves output packet space for the 4-byte CRC. Attackers can supply audio whose sample values and length produce a small, poorly compressible final frame, triggering the av_assert0() in flush_put_bits() and aborting applications transcoding to TTA.1dCVE-2026-174276.5 MED8.8%
——3IBM Power Systems Firmware FW1060.00 through FW1060.81, OP940.00 through OP940.A2, OP910.00 through OP910.95, and OP940.00 through OP940.82 could allow a remote attacker to cause a denial of service due to improper validation of input length.1d