CVE-2026-125066 · Package
NO FIX YET
FFmpeg's Cirrus Logic AccuPak (CLJR) decoder ignores a bit-reader initialization failure, so a crafted AVI file with an oversized frame causes a NULL buffer read. An attacker gets the FFmpeg process to crash when it opens the file.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications that use FFmpeg's libavcodec to decode untrusted AVI files with the CLJR codec are exposed to a crash. The sources do not say which FFmpeg versions carry the fix or which configurations are affected beyond the decoder itself.
Not affected if no-untrusted-media-input
Who cares ffmpeg, libavcodec, media-processing
Unknown from the sources.
No fix yet, per the sources.
FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in the Cirrus Logic AccuPak (CLJR) decoder in libavcodec/cljrdec.c because decode_frame() ignores init_get_bits() failure. Attackers can supply a crafted AVI file with a 2^28-byte CLJR frame that overflows the bit count, causing reads from a NULL buffer and crashing the process.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.