CVE-2026-125073 · Runtime
NO FIX YET
FFmpeg's IMC decoder in libavcodec/imc.c enters an infinite loop in bit_allocation() when an audio block has a negative bit budget. An attacker who supplies a crafted IMC or IAC audio file can hang decoding and consume 100% CPU.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Services that run FFmpeg to decode audio uploaded or supplied by outside users are the ones exposed, since a crafted file can stall the decoder. Systems that only process trusted local media, or that do not decode IMC or IAC audio, are unlikely to be affected. The sources do not list the exact affected builds beyond 'through 9.0.2'.
Not affected if no-imc-iac-decoding, trusted-input-only
Who cares ffmpeg, media-processing, self-hosted
ffmpeg -version and compare against the fixed release in the product ranges (unknown in the sources).No fix yet, per the sources.
FFmpeg through 9.0.2 contains an infinite loop vulnerability in bit_allocation() in libavcodec/imc.c that allows attackers to hang decoding by supplying audio blocks with a negative bit budget. Attackers can craft IMC or IAC audio files that drive freebits negative, causing the reduction loop to never terminate and consuming 100% CPU.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.