{"id":"CVE-2026-125071","kind":"vulnerability","aliases":["CVE-2026-125071"],"related":[],"title":"FFmpeg: oversized JV video packet crashes decoder with a NULL dereference","description":"FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in libavcodec/jvdec.c that allows attackers to crash applications by supplying oversized JV video packets. Attackers can pass a roughly 268435460-byte packet through the libavcodec API, overflowing the bit count so decode_frame() reads from a NULL buffer and causes denial of service.","summary":"FFmpeg through 9.0.2 has a NULL pointer dereference in the JV video decoder (libavcodec/jvdec.c). An attacker who supplies an oversized JV packet through the libavcodec API can crash the application, causing denial of service.","severity":"medium","cvss":5.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ffmpeg","libavcodec","media-processing","package"],"not_affected_if":["no-jv-decoding","trusted-input-only"],"how_to_check":"- Check whether the application links FFmpeg libavcodec and which version it ships, for example with `ffmpeg -version`\n- Confirm whether the application decodes untrusted JV video input","fix":null,"status":"open","published_at":"2026-11-09T19:16:49+00:00","first_seen_at":"2026-11-09T19:28:15+00:00","triaged_at":"2026-11-09T19:32:08+00:00","updated_at":"2026-11-09T19:32:08+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-09T19:32:08Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"FFmpeg: oversized JV video packet crashes decoder with a NULL dereference","impact":"low","summary":"FFmpeg through 9.0.2 has a NULL pointer dereference in the JV video decoder (libavcodec/jvdec.c). An attacker who supplies an oversized JV packet through the libavcodec API can crash the application, causing denial of service.","audience":"developers","category":"package","nicknames":[],"who_cares":["ffmpeg","libavcodec","media-processing"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"Application crashes from a NULL dereference, causing denial of service","analyst_note":"Confirm the fixed version and the patch commit from the linked GitHub patch, since the sources do not name a fixed version.","how_to_check":"- Check whether the application links FFmpeg libavcodec and which version it ships, for example with `ffmpeg -version`\n- Confirm whether the application decodes untrusted JV video input\n- unknown for any setting that changes exposure","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["trusted-input-only","no-jv-decoding"],"who_is_affected":"Applications that link FFmpeg libavcodec and pass it JV video packets from untrusted sources can be crashed by an oversized packet. Services that only decode trusted local media are much less exposed. The sources do not state a fixed version, though a patch link is listed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00074,"input_tokens":4631,"output_tokens":553,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125071':14A,17A '-2026':13A,16A '268435460':86C '9.0.2':26B,60C 'allow':70C 'api':49B,92C 'applic':53B,74C 'attack':39B,71C,81C 'bit':95C 'buffer':104C 'byte':87C 'caus':54B,106C 'contain':61C 'count':96C 'crash':6A,51B,73C 'cve':12A,15A 'decod':7A,36B,98C 'denial':55B,107C 'derefer':11A,31B,65C 'ffmpeg':1A,18B,24B,58C 'frame':99C 'jv':3A,34B,44B,78C 'libavcodec':19B,48B,91C 'libavcodec/jvdec.c':37B,68C 'media':21B 'media-process':20B 'null':10A,29B,63C,103C 'overflow':93C 'overs':2A,43B,77C 'packag':23B 'packet':5A,45B,80C,88C 'pass':83C 'pointer':30B,64C 'process':22B 'read':100C 'rough':85C 'servic':57B,109C 'suppli':41B,76C 'video':4A,35B,79C 'vulner':66C","nicknames":[],"mitigations":[],"who_affected":"Applications that link FFmpeg libavcodec and pass it JV video packets from untrusted sources can be crashed by an oversized packet. Services that only decode trusted local media are much less exposed. The sources do not state a fixed version, though a patch link is listed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ffmpeg","libavcodec","mediaprocessing","medium","package"],"campaign_type":null,"search_a":"'-125071':14A,17A '-2026':13A,16A 'crash':6A 'cve':12A,15A 'decod':7A 'derefer':11A 'ffmpeg':1A 'jv':3A 'null':10A 'overs':2A 'packet':5A 'video':4A","search_b":"'9.0.2':26B 'api':49B 'applic':53B 'attack':39B 'caus':54B 'crash':51B 'decod':36B 'denial':55B 'derefer':31B 'ffmpeg':18B,24B 'jv':34B,44B 'libavcodec':19B,48B 'libavcodec/jvdec.c':37B 'media':21B 'media-process':20B 'null':29B 'overs':43B 'packag':23B 'packet':45B 'pointer':30B 'process':22B 'servic':57B 'suppli':41B 'video':35B","search_c":"'268435460':86C '9.0.2':60C 'allow':70C 'api':92C 'applic':74C 'attack':71C,81C 'bit':95C 'buffer':104C 'byte':87C 'caus':106C 'contain':61C 'count':96C 'crash':73C 'decod':98C 'denial':107C 'derefer':65C 'ffmpeg':58C 'frame':99C 'jv':78C 'libavcodec':91C 'libavcodec/jvdec.c':68C 'null':63C,103C 'overflow':93C 'overs':77C 'packet':80C,88C 'pass':83C 'pointer':64C 'read':100C 'rough':85C 'servic':109C 'suppli':76C 'video':79C 'vulner':66C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T19:16:49+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125071","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125071","severity":null,"published_at":"2026-11-09T19:16:49+00:00","modified_at":"2026-11-09T19:16:49+00:00","first_seen_at":"2026-11-09T19:28:15+00:00","fetched_at":"2026-11-09T19:28:15+00:00","note":null}],"documents":[{"id":109201,"url":"https://github.com/FFmpeg/FFmpeg/commit/839c93f261cd3e1719edfac4244a2d0055ce8841","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109202,"url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-null-pointer-dereference-in-jv-video-decoder","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}