{"id":"CVE-2026-125073","kind":"vulnerability","aliases":["CVE-2026-125073"],"related":[],"title":"FFmpeg: crafted IMC audio file hangs decoder at full CPU","description":"FFmpeg through 9.0.2 contains an infinite loop vulnerability in bit_allocation() in libavcodec/imc.c that allows attackers to hang decoding by supplying audio blocks with a negative bit budget. Attackers can craft IMC or IAC audio files that drive freebits negative, causing the reduction loop to never terminate and consuming 100% CPU.","summary":"FFmpeg's IMC decoder in libavcodec/imc.c enters an infinite loop in bit_allocation() when an audio block has a negative bit budget. An attacker who supplies a crafted IMC or IAC audio file can hang decoding and consume 100% CPU.","severity":"medium","cvss":6.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ffmpeg","media-processing","runtime","self-hosted"],"not_affected_if":["no-imc-iac-decoding","trusted-input-only"],"how_to_check":"- Run `ffmpeg -version` and compare against the fixed release in the product ranges (unknown in the sources).\n- Check whether your pipeline decodes untrusted IMC or IAC audio files.","fix":null,"status":"open","published_at":"2026-11-09T19:16:50+00:00","first_seen_at":"2026-11-09T19:28:15+00:00","triaged_at":"2026-11-09T19:31:39+00:00","updated_at":"2026-11-09T19:31:39+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-09T19:31:39Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"FFmpeg: crafted IMC audio file hangs decoder at full CPU","impact":"low","summary":"FFmpeg's IMC decoder in libavcodec/imc.c enters an infinite loop in bit_allocation() when an audio block has a negative bit budget. An attacker who supplies a crafted IMC or IAC audio file can hang decoding and consume 100% CPU.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["ffmpeg","media-processing","self-hosted"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"decoder hangs and consumes a full CPU core","analyst_note":"Confirm the fixed FFmpeg version from the linked patch on github.com and the vendor advisory before writing a fix.","how_to_check":"- Run `ffmpeg -version` and compare against the fixed release in the product ranges (unknown in the sources).\n- Check whether your pipeline decodes untrusted IMC or IAC audio files.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["trusted-input-only","no-imc-iac-decoding"],"who_is_affected":"Services that run FFmpeg to decode audio uploaded or supplied by outside users are the ones exposed, since a crafted file can stall the decoder. Systems that only process trusted local media, or that do not decode IMC or IAC audio, are unlikely to be affected. The sources do not list the exact affected builds beyond 'through 9.0.2'.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000754,"input_tokens":4626,"output_tokens":582,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125073':13A,16A '-2026':12A,15A '100':63B,114C '9.0.2':67C 'alloc':37B,75C 'allow':79C 'attack':48B,80C,93C 'audio':4A,40B,56B,86C,99C 'bit':36B,45B,74C,91C 'block':41B,87C 'budget':46B,92C 'caus':105C 'consum':62B,113C 'contain':68C 'cpu':10A,64B,115C 'craft':2A,52B,95C 'cve':11A,14A 'decod':7A,28B,60B,83C 'drive':102C 'enter':31B 'ffmpeg':1A,17B,25B,65C 'file':5A,57B,100C 'freebit':103C 'full':9A 'hang':6A,59B,82C 'host':24B 'iac':55B,98C 'imc':3A,27B,53B,96C 'infinit':33B,70C 'libavcodec/imc.c':30B,77C 'loop':34B,71C,108C 'media':19B 'media-process':18B 'negat':44B,90C,104C 'never':110C 'process':20B 'reduct':107C 'runtim':21B 'self':23B 'self-host':22B 'suppli':50B,85C 'termin':111C 'vulner':72C","nicknames":[],"mitigations":[],"who_affected":"Services that run FFmpeg to decode audio uploaded or supplied by outside users are the ones exposed, since a crafted file can stall the decoder. Systems that only process trusted local media, or that do not decode IMC or IAC audio, are unlikely to be affected. The sources do not list the exact affected builds beyond 'through 9.0.2'.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ffmpeg","mediaprocessing","medium","runtime","selfhosted"],"campaign_type":null,"search_a":"'-125073':13A,16A '-2026':12A,15A 'audio':4A 'cpu':10A 'craft':2A 'cve':11A,14A 'decod':7A 'ffmpeg':1A 'file':5A 'full':9A 'hang':6A 'imc':3A","search_b":"'100':63B 'alloc':37B 'attack':48B 'audio':40B,56B 'bit':36B,45B 'block':41B 'budget':46B 'consum':62B 'cpu':64B 'craft':52B 'decod':28B,60B 'enter':31B 'ffmpeg':17B,25B 'file':57B 'hang':59B 'host':24B 'iac':55B 'imc':27B,53B 'infinit':33B 'libavcodec/imc.c':30B 'loop':34B 'media':19B 'media-process':18B 'negat':44B 'process':20B 'runtim':21B 'self':23B 'self-host':22B 'suppli':50B","search_c":"'100':114C '9.0.2':67C 'alloc':75C 'allow':79C 'attack':80C,93C 'audio':86C,99C 'bit':74C,91C 'block':87C 'budget':92C 'caus':105C 'consum':113C 'contain':68C 'cpu':115C 'craft':95C 'decod':83C 'drive':102C 'ffmpeg':65C 'file':100C 'freebit':103C 'hang':82C 'iac':98C 'imc':96C 'infinit':70C 'libavcodec/imc.c':77C 'loop':71C,108C 'negat':90C,104C 'never':110C 'reduct':107C 'suppli':85C 'termin':111C 'vulner':72C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T19:16:50+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125073","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125073","severity":null,"published_at":"2026-11-09T19:16:50+00:00","modified_at":"2026-11-09T19:16:50+00:00","first_seen_at":"2026-11-09T19:28:15+00:00","fetched_at":"2026-11-09T19:28:15+00:00","note":null}],"documents":[{"id":109205,"url":"https://github.com/FFmpeg/FFmpeg/commit/9b26bb4c9a4457d480899a1bf64ec080eceb1acd","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109206,"url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-infinite-loop-denial-of-service-via-imc-iac-decoder","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}