{"id":"CVE-2026-125072","kind":"vulnerability","aliases":["CVE-2026-125072"],"related":[],"title":"FFmpeg: oversized MP3 packet crashes the decoder through a NULL pointer","description":"FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in mp_decode_frame() in libavcodec/mpegaudiodec_template.c because init_get_bits() failure is ignored after a signed integer overflow. Attackers can pass an oversized packet to the mp3adu decoder through the libavcodec API, causing reads through a NULL buffer that crash the process.","summary":"FFmpeg's MP3 decoder (mp_decode_frame in libavcodec) ignores a failed bit-reader setup after a signed integer overflow, so it reads through a NULL buffer. An attacker who can pass an oversized packet to the mp3adu decoder can crash the process.","severity":"medium","cvss":5.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ffmpeg","libavcodec","media-processing","package"],"not_affected_if":["no-untrusted-audio-input"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-09T19:16:49+00:00","first_seen_at":"2026-11-09T19:28:15+00:00","triaged_at":"2026-11-09T19:32:05+00:00","updated_at":"2026-11-09T19:32:05+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-09T19:32:05Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"FFmpeg: oversized MP3 packet crashes the decoder through a NULL pointer","impact":"low","summary":"FFmpeg's MP3 decoder (mp_decode_frame in libavcodec) ignores a failed bit-reader setup after a signed integer overflow, so it reads through a NULL buffer. An attacker who can pass an oversized packet to the mp3adu decoder can crash the process.","audience":"businesses","category":"package","nicknames":[],"who_cares":["ffmpeg","libavcodec","media-processing"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"process crashes through NULL pointer dereference on oversized packet","analyst_note":"Confirm affected version range and fixed release from the linked patch on github.com and the VulnCheck advisory; sources list no fixed version.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-untrusted-audio-input"],"who_is_affected":"Applications that link FFmpeg's libavcodec and decode untrusted audio through the mp3adu decoder are the exposed ones. Services that only process trusted local files or do not decode MP3 data can likely skip it. The sources do not name affected version ranges beyond 'through 9.0.2'.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000717,"input_tokens":4627,"output_tokens":509,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125072':14A,17A '-2026':13A,16A '9.0.2':70C 'api':108C 'attack':53B,95C 'bit':37B,86C 'bit-read':36B 'buffer':51B,114C 'caus':109C 'contain':71C 'crash':5A,65B,116C 'cve':12A,15A 'decod':7A,27B,29B,63B,79C,104C 'derefer':75C 'fail':35B 'failur':87C 'ffmpeg':1A,18B,24B,68C 'frame':30B,80C 'get':85C 'ignor':33B,89C 'init':84C 'integ':43B,93C 'libavcodec':19B,32B,107C 'libavcodec/mpegaudiodec_template.c':82C 'media':21B 'media-process':20B 'mp':28B,78C 'mp3':3A,26B 'mp3adu':62B,103C 'null':10A,50B,73C,113C 'overflow':44B,94C 'overs':2A,58B,99C 'packag':23B 'packet':4A,59B,100C 'pass':56B,97C 'pointer':11A,74C 'process':22B,67B,118C 'read':47B,110C 'reader':38B 'setup':39B 'sign':42B,92C 'vulner':76C","nicknames":[],"mitigations":[],"who_affected":"Applications that link FFmpeg's libavcodec and decode untrusted audio through the mp3adu decoder are the exposed ones. Services that only process trusted local files or do not decode MP3 data can likely skip it. The sources do not name affected version ranges beyond 'through 9.0.2'.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ffmpeg","libavcodec","mediaprocessing","medium","package"],"campaign_type":null,"search_a":"'-125072':14A,17A '-2026':13A,16A 'crash':5A 'cve':12A,15A 'decod':7A 'ffmpeg':1A 'mp3':3A 'null':10A 'overs':2A 'packet':4A 'pointer':11A","search_b":"'attack':53B 'bit':37B 'bit-read':36B 'buffer':51B 'crash':65B 'decod':27B,29B,63B 'fail':35B 'ffmpeg':18B,24B 'frame':30B 'ignor':33B 'integ':43B 'libavcodec':19B,32B 'media':21B 'media-process':20B 'mp':28B 'mp3':26B 'mp3adu':62B 'null':50B 'overflow':44B 'overs':58B 'packag':23B 'packet':59B 'pass':56B 'process':22B,67B 'read':47B 'reader':38B 'setup':39B 'sign':42B","search_c":"'9.0.2':70C 'api':108C 'attack':95C 'bit':86C 'buffer':114C 'caus':109C 'contain':71C 'crash':116C 'decod':79C,104C 'derefer':75C 'failur':87C 'ffmpeg':68C 'frame':80C 'get':85C 'ignor':89C 'init':84C 'integ':93C 'libavcodec':107C 'libavcodec/mpegaudiodec_template.c':82C 'mp':78C 'mp3adu':103C 'null':73C,113C 'overflow':94C 'overs':99C 'packet':100C 'pass':97C 'pointer':74C 'process':118C 'read':110C 'sign':92C 'vulner':76C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T19:16:49+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125072","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125072","severity":null,"published_at":"2026-11-09T19:16:49+00:00","modified_at":"2026-11-09T19:16:49+00:00","first_seen_at":"2026-11-09T19:28:15+00:00","fetched_at":"2026-11-09T19:28:15+00:00","note":null}],"documents":[{"id":109203,"url":"https://github.com/FFmpeg/FFmpeg/commit/0b007e0634de5b4424b9993c95a6c1c50de0115b","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109204,"url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-null-pointer-dereference-in-mpeg-audio-decoder","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}