{"id":"CVE-2026-125065","kind":"vulnerability","aliases":["CVE-2026-125065"],"related":[],"title":"FFmpeg: crafted EA video file crashes the decoder with a NULL dereference","description":"FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in tgv_decode_inter() in libavcodec/eatgv.c that ignores init_get_bits() failure on oversized packets. Attackers can supply a crafted EA file with a kVGT frame followed by an fVGT inter frame with a 2^28-byte compressed block section, crashing the process for denial of service.","summary":"FFmpeg through 9.0.2 has a NULL pointer dereference in the EA TGV decoder (libavcodec/eatgv.c) because it ignores a failed init_get_bits() on oversized packets. An attacker who supplies a crafted EA file can crash the process, causing denial of service.","severity":"medium","cvss":6.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ffmpeg","libavcodec","media-processing","package"],"not_affected_if":["no-ea-video-decoding","no-untrusted-media"],"how_to_check":"- Check the installed FFmpeg version with `ffmpeg -version`; the sources say versions through 9.0.2 are affected.\n- Find out whether anything decodes untrusted EA (.tgv/.cmv-style Electronic Arts) media files with FFmpeg or libavcodec.","fix":null,"status":"open","published_at":"2026-11-09T19:16:48+00:00","first_seen_at":"2026-11-09T19:28:15+00:00","triaged_at":"2026-11-09T19:31:47+00:00","updated_at":"2026-11-09T19:31:47+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-09T19:31:47Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"FFmpeg: crafted EA video file crashes the decoder with a NULL dereference","impact":"low","summary":"FFmpeg through 9.0.2 has a NULL pointer dereference in the EA TGV decoder (libavcodec/eatgv.c) because it ignores a failed init_get_bits() on oversized packets. An attacker who supplies a crafted EA file can crash the process, causing denial of service.","audience":"businesses","category":"package","nicknames":[],"who_cares":["ffmpeg","libavcodec","media-processing"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker crashes the decoding process, causing denial of service.","analyst_note":"Check the Patch link on github.com and the vulncheck advisory for the fixed FFmpeg version and whether default builds reach the EA decoder.","how_to_check":"- Check the installed FFmpeg version with `ffmpeg -version`; the sources say versions through 9.0.2 are affected.\n- Find out whether anything decodes untrusted EA (.tgv/.cmv-style Electronic Arts) media files with FFmpeg or libavcodec.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-untrusted-media","no-ea-video-decoding"],"who_is_affected":"Systems that run FFmpeg or libavcodec on untrusted media, such as upload-and-transcode services, media pipelines and thumbnailers. Only the EA TGV decoder path is named, so systems that never decode EA video files are unlikely to be exposed. The sources do not say whether the crash is reachable through default configuration.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000778,"input_tokens":4641,"output_tokens":628,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125065':15A,18A '-2026':14A,17A '2':109C '28':110C '9.0.2':27B,68C 'attack':51B,90C 'bit':46B,85C 'block':113C 'byte':111C 'caus':62B 'compress':112C 'contain':69C 'craft':2A,55B,94C 'crash':6A,59B,115C 'cve':13A,16A 'decod':8A,37B,77C 'denial':63B,119C 'derefer':12A,32B,73C 'ea':3A,35B,56B,95C 'fail':43B 'failur':86C 'ffmpeg':1A,19B,25B,66C 'file':5A,57B,96C 'follow':101C 'frame':100C,106C 'fvgt':104C 'get':45B,84C 'ignor':41B,82C 'init':44B,83C 'inter':78C,105C 'kvgt':99C 'libavcodec':20B 'libavcodec/eatgv.c':38B,80C 'media':22B 'media-process':21B 'null':11A,30B,71C 'overs':48B,88C 'packag':24B 'packet':49B,89C 'pointer':31B,72C 'process':23B,61B,117C 'section':114C 'servic':65B,121C 'suppli':53B,92C 'tgv':36B,76C 'video':4A 'vulner':74C","nicknames":[],"mitigations":[],"who_affected":"Systems that run FFmpeg or libavcodec on untrusted media, such as upload-and-transcode services, media pipelines and thumbnailers. Only the EA TGV decoder path is named, so systems that never decode EA video files are unlikely to be exposed. The sources do not say whether the crash is reachable through default configuration.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ffmpeg","libavcodec","mediaprocessing","medium","package"],"campaign_type":null,"search_a":"'-125065':15A,18A '-2026':14A,17A 'craft':2A 'crash':6A 'cve':13A,16A 'decod':8A 'derefer':12A 'ea':3A 'ffmpeg':1A 'file':5A 'null':11A 'video':4A","search_b":"'9.0.2':27B 'attack':51B 'bit':46B 'caus':62B 'craft':55B 'crash':59B 'decod':37B 'denial':63B 'derefer':32B 'ea':35B,56B 'fail':43B 'ffmpeg':19B,25B 'file':57B 'get':45B 'ignor':41B 'init':44B 'libavcodec':20B 'libavcodec/eatgv.c':38B 'media':22B 'media-process':21B 'null':30B 'overs':48B 'packag':24B 'packet':49B 'pointer':31B 'process':23B,61B 'servic':65B 'suppli':53B 'tgv':36B","search_c":"'2':109C '28':110C '9.0.2':68C 'attack':90C 'bit':85C 'block':113C 'byte':111C 'compress':112C 'contain':69C 'craft':94C 'crash':115C 'decod':77C 'denial':119C 'derefer':73C 'ea':95C 'failur':86C 'ffmpeg':66C 'file':96C 'follow':101C 'frame':100C,106C 'fvgt':104C 'get':84C 'ignor':82C 'init':83C 'inter':78C,105C 'kvgt':99C 'libavcodec/eatgv.c':80C 'null':71C 'overs':88C 'packet':89C 'pointer':72C 'process':117C 'section':114C 'servic':121C 'suppli':92C 'tgv':76C 'vulner':74C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T19:16:48+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125065","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125065","severity":null,"published_at":"2026-11-09T19:16:48+00:00","modified_at":"2026-11-09T19:16:48+00:00","first_seen_at":"2026-11-09T19:28:15+00:00","fetched_at":"2026-11-09T19:28:15+00:00","note":null}],"documents":[{"id":109189,"url":"https://github.com/FFmpeg/FFmpeg/commit/9691e4fde64e14de73c298562c4e475f9412b5ad","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109190,"url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-null-pointer-dereference-via-tgv-decoder-eatgv-c","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}