CVE-2026-125069 · Package
NO FIX YET
FFmpeg's Motion Pixels decoder ignores a bit-reader setup failure, so an oversized packet passed through the libavcodec API leads to a NULL buffer read. An attacker gets a process crash, which is a denial of service.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Systems that feed untrusted media through FFmpeg or libavcodec and decode Motion Pixels streams are exposed to a crash. Systems that only process trusted files or do not use this codec can likely skip it. The sources do not name a fixed version; the linked patch is the vendor's reference.
Not affected if codec-unused, trusted-input-only
Who cares ffmpeg, libavcodec, media-processing
ffmpeg -version, or the libavcodec version your application links against.No fix yet, per the sources.
FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in the Motion Pixels decoder because mp_decode_frame() ignores init_get_bits() failure. Attackers supplying a roughly 2^28-byte packet through the libavcodec API overflow the bit count, causing reads from a NULL buffer that crash the process.
This page as .md · .json · CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.