CVE-2026-125220
FFmpeg through 9.0.2 contains a deadlock vulnerability in mimic_decode_frame() in libavcodec/mimic.c that fails to report frame progress whe
CVSS
5.5
Medio
EPSS
0.1%
p2
KEV
—
Exploit Today
1
0-100
Publicado: 9 nov 2026 · Última mod.: 10 nov 2026 · CWE-833
Sin historial EPSS suficiente todavía.
FFmpeg through 9.0.2 contains a deadlock vulnerability in mimic_decode_frame() in libavcodec/mimic.c that fails to report frame progress when init_get_bits8() fails. Attackers can supply a crafted file with an oversized Mimic intra frame followed by inter frames to hang frame-threaded decoding indefinitely.
- code.ffmpeg.orghttps://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25718
- github.comhttps://github.com/FFmpeg/FFmpeg
- github.comhttps://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/mimic.c#L403
- github.comhttps://github.com/FFmpeg/FFmpeg/commit/db77b0b8318ddb38b5a3227724da088a325a4308
- www.vulncheck.comhttps://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-mimic-decoder-deadlock-via-frame-threading-failure
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-1260725.9 MED—
———Action Pack is a framework for handling and responding to web requests. Prior to 8.1.4.1 and 8.0.5.2, ActionController::Live::Buffer#close pushes its end-of-stream marker onto the response's bounded queue while it holds the buffer's monitor. When the client has stopped reading and the queue is full, the push blocks, and Buffer#abort, which runs when the client disconnects or a write times out, waits indefinitely for the same monitor. Each such response could permanently hold a web server thread and its ActionController::Live thread, possibly resulting in a DoS vulnerability through thread exhaustion. Applications that stream responses with ActionController::Live, including send_stream, are affected. Applications that serve large files through Active Storage proxy mode are exposed to unauthenticated clients. This issue is fixed in versions 8.1.4.1 and 8.0.5.2.9hCVE-2026-21407——
——0Deadlock for some Intel(R) Arc(TM) B-series graphics cards within Ring 1: Device Drivers may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present with special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.8hCVE-2026-118052—1.4%
——0In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the Module Manager loaders return an overflow error without releasing the Module Manager mutex when a module preamble declares a data or stack size that overflows the allocation arithmetic. Loading such an image blocks every later module load, start, stop and unload from other threads until the system is reset.8dCVE-2026-105390—1.5%
——0Improper synchronization in the OpenVPN ovpn-dco-win for Windows versions 0.6.5 through 1.3.5 and 2.4.0 through 2.8.7 allows local attackers to trigger a deadlock via a crafted write to the ovpn-dco device, causing the host to become unresponsive.26dCVE-2026-701867.5 ALT61.8%
——19Deadlock in ASP.NET Core allows an unauthorized attacker to deny service over a network.28dCVE-2026-1035587.5 ALT62.4%
——19Deadlock in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to deny service over a network.16d