CVE-2026-125065 · Package
NO FIX YET
FFmpeg through 9.0.2 has a NULL pointer dereference in the EA TGV decoder (libavcodec/eatgv.c) because it ignores a failed init_get_bits() on oversized packets. An attacker who supplies a crafted EA file can crash the process, causing denial of service.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Systems that run FFmpeg or libavcodec on untrusted media, such as upload-and-transcode services, media pipelines and thumbnailers. Only the EA TGV decoder path is named, so systems that never decode EA video files are unlikely to be exposed. The sources do not say whether the crash is reachable through default configuration.
Not affected if no-ea-video-decoding, no-untrusted-media
Who cares ffmpeg, libavcodec, media-processing
ffmpeg -version; the sources say versions through 9.0.2 are affected.No fix yet, per the sources.
FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in tgv_decode_inter() in libavcodec/eatgv.c that ignores init_get_bits() failure on oversized packets. Attackers can supply a crafted EA file with a kVGT frame followed by an fVGT inter frame with a 2^28-byte compressed block section, crashing the process for denial of service.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.