CVE-2026-125064 · Package
NO FIX YET · SEE WHAT TO DO
FFmpeg's G.726 audio decoder in libavcodec ignores a failed buffer setup when given an oversized packet. A crafted AVI file with a very large G.726 audio chunk makes the process read from a NULL buffer and crash.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications that pass untrusted AVI files with G.726 audio to FFmpeg's libavcodec decoder are exposed to a crash. Services that only process trusted media, or that do not decode G.726 audio, can skip it. The sources do not describe code execution, only a process crash.
Not affected if g726-not-decoded, no-untrusted-media
Who cares ffmpeg, libavcodec, media-processing
ffmpeg -version and compare against the fixed release in the sources, which the sources do not state: unknownFFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in g726_decode_frame() in libavcodec/g726.c because it ignores init_get_bits() failure on oversized packets. Attackers can supply a crafted AVI file with a 268435392-byte G.726 audio chunk to make the decoder read from a NULL buffer, crashing the process.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.