CVE-2026-125068 · Package
NO FIX YET
FFmpeg's Bink video decoder ignores a failed bit-reader initialization, causing a NULL pointer dereference. An attacker who supplies a crafted Bink file can crash the process, a denial of service.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Systems that decode Bink video files with FFmpeg, such as media processing pipelines or services accepting user uploads, may be exposed to a crash from a malicious file. Applications that never decode Bink content are unlikely to reach the vulnerable code path. The sources do not state a fixed version.
Not affected if no-bink-decoding
Who cares ffmpeg, libavcodec, media-processing
Unknown from the sources.
No fix yet, per the sources.
FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in the Bink video decoder because decode_frame() in libavcodec/bink.c ignores init_get_bits() failure. Attackers can supply a crafted Bink file with a frame of about 2^28 bytes, overflowing the bit count and crashing the process for denial of service.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.