{"id":"CVE-2026-125067","kind":"vulnerability","aliases":["CVE-2026-125067"],"related":[],"title":"FFmpeg: crafted AVI file crashes decoder through NULL pointer dereference","description":"FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in vble_decode_frame() in libavcodec/vble.c because it ignores init_get_bits() failure on oversized packets. Attackers can supply a crafted AVI file with a 268435452-byte VBLE frame, causing reads from a NULL bit reader buffer that crash the process.","summary":"FFmpeg's VBLE video decoder in libavcodec ignores a bit reader setup failure on oversized frames, leaving a NULL buffer that gets read. An attacker who supplies a crafted AVI file can crash the process that decodes it.","severity":"medium","cvss":6.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ffmpeg","libavcodec","media-processing","package"],"not_affected_if":["no-untrusted-avi-input"],"how_to_check":"- Check the installed FFmpeg version with `ffmpeg -version`, since the description says versions through 9.0.2 are affected\n- Look for applications or services that decode AVI files supplied by users or other systems","fix":null,"status":"open","published_at":"2026-11-09T19:16:49+00:00","first_seen_at":"2026-11-09T19:28:15+00:00","triaged_at":"2026-11-09T19:31:44+00:00","updated_at":"2026-11-09T19:31:44+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-09T19:31:44Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"FFmpeg: crafted AVI file crashes decoder through NULL pointer dereference","impact":"low","summary":"FFmpeg's VBLE video decoder in libavcodec ignores a bit reader setup failure on oversized frames, leaving a NULL buffer that gets read. An attacker who supplies a crafted AVI file can crash the process that decodes it.","audience":"businesses","category":"package","nicknames":[],"who_cares":["ffmpeg","libavcodec","media-processing"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker crashes the decoding process with a malformed AVI file","analyst_note":"Confirm the fixed FFmpeg version and whether the patch at github.com is linked to this CVE; the sources give no fix version.","how_to_check":"- Check the installed FFmpeg version with `ffmpeg -version`, since the description says versions through 9.0.2 are affected\n- Look for applications or services that decode AVI files supplied by users or other systems\n- unknown whether a specific build or configuration is required","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-untrusted-avi-input"],"who_is_affected":"Systems that run FFmpeg's libavcodec to decode AVI files from untrusted sources, such as media upload, transcoding or thumbnail services. Environments that never decode untrusted AVI input are less exposed. The sources do not say whether a non-default build or codec setting is required.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000749,"input_tokens":4629,"output_tokens":572,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125067':13A,16A '-2026':12A,15A '268435452':94C '9.0.2':62C 'attack':47B,85C 'avi':3A,52B,90C 'bit':32B,80C,103C 'buffer':42B,105C 'byte':95C 'caus':98C 'contain':63C 'craft':2A,51B,89C 'crash':5A,55B,107C 'cve':11A,14A 'decod':6A,27B,59B,71C 'derefer':10A,67C 'failur':35B,81C 'ffmpeg':1A,17B,23B,60C 'file':4A,53B,91C 'frame':38B,72C,97C 'get':44B,79C 'ignor':30B,77C 'init':78C 'leav':39B 'libavcodec':18B,29B 'libavcodec/vble.c':74C 'media':20B 'media-process':19B 'null':8A,41B,65C,102C 'overs':37B,83C 'packag':22B 'packet':84C 'pointer':9A,66C 'process':21B,57B,109C 'read':45B,99C 'reader':33B,104C 'setup':34B 'suppli':49B,87C 'vble':25B,70C,96C 'video':26B 'vulner':68C","nicknames":[],"mitigations":[],"who_affected":"Systems that run FFmpeg's libavcodec to decode AVI files from untrusted sources, such as media upload, transcoding or thumbnail services. Environments that never decode untrusted AVI input are less exposed. The sources do not say whether a non-default build or codec setting is required.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ffmpeg","libavcodec","mediaprocessing","medium","package"],"campaign_type":null,"search_a":"'-125067':13A,16A '-2026':12A,15A 'avi':3A 'craft':2A 'crash':5A 'cve':11A,14A 'decod':6A 'derefer':10A 'ffmpeg':1A 'file':4A 'null':8A 'pointer':9A","search_b":"'attack':47B 'avi':52B 'bit':32B 'buffer':42B 'craft':51B 'crash':55B 'decod':27B,59B 'failur':35B 'ffmpeg':17B,23B 'file':53B 'frame':38B 'get':44B 'ignor':30B 'leav':39B 'libavcodec':18B,29B 'media':20B 'media-process':19B 'null':41B 'overs':37B 'packag':22B 'process':21B,57B 'read':45B 'reader':33B 'setup':34B 'suppli':49B 'vble':25B 'video':26B","search_c":"'268435452':94C '9.0.2':62C 'attack':85C 'avi':90C 'bit':80C,103C 'buffer':105C 'byte':95C 'caus':98C 'contain':63C 'craft':89C 'crash':107C 'decod':71C 'derefer':67C 'failur':81C 'ffmpeg':60C 'file':91C 'frame':72C,97C 'get':79C 'ignor':77C 'init':78C 'libavcodec/vble.c':74C 'null':65C,102C 'overs':83C 'packet':84C 'pointer':66C 'process':109C 'read':99C 'reader':104C 'suppli':87C 'vble':70C,96C 'vulner':68C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T19:16:49+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125067","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125067","severity":null,"published_at":"2026-11-09T19:16:49+00:00","modified_at":"2026-11-09T19:16:49+00:00","first_seen_at":"2026-11-09T19:28:15+00:00","fetched_at":"2026-11-09T19:28:15+00:00","note":null}],"documents":[{"id":109193,"url":"https://github.com/FFmpeg/FFmpeg/commit/1206df65e54b6e9c01459c7cd9a95f9bde2736d7","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109194,"url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-vble-decoder-null-pointer-dereference-via-vble-decode-frame","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}