CVE-2026-125071 · Package
NO FIX YET
FFmpeg through 9.0.2 has a NULL pointer dereference in the JV video decoder (libavcodec/jvdec.c). An attacker who supplies an oversized JV packet through the libavcodec API can crash the application, causing denial of service.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications that link FFmpeg libavcodec and pass it JV video packets from untrusted sources can be crashed by an oversized packet. Services that only decode trusted local media are much less exposed. The sources do not state a fixed version, though a patch link is listed.
Not affected if no-jv-decoding, trusted-input-only
Who cares ffmpeg, libavcodec, media-processing
ffmpeg -versionNo fix yet, per the sources.
FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in libavcodec/jvdec.c that allows attackers to crash applications by supplying oversized JV video packets. Attackers can pass a roughly 268435460-byte packet through the libavcodec API, overflowing the bit count so decode_frame() reads from a NULL buffer and causes denial of service.
This page as .md · .json · CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.