CVE-2026-125070 · Package
NO FIX YET
FFmpeg's EA TQI decoder ignores a failed bit-reader setup after an integer overflow, leaving a NULL pointer dereference. A crafted EA file with an oversized pIQT chunk crashes the process, causing denial of service.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Any system that runs FFmpeg's libavcodec on media files from untrusted sources can be crashed by a crafted EA file. Systems that only decode trusted local media are much less exposed. unknown whether a specific fixed version is stated in the sources.
Not affected if no-ea-decoder-use, trusted-input-only
Who cares ffmpeg, libavcodec, media-processing
ffmpeg -version; versions through 9.0.2 are described as affected.No fix yet, per the sources.
FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in tqi_decode_frame() in libavcodec/eatqi.c, which ignores init_get_bits() failure after an integer overflow. Attackers can supply a crafted EA file with a pIQT chunk carrying a 2^28-byte payload to crash the process, causing denial of service.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.