{"id":"CVE-2026-125172","kind":"vulnerability","aliases":["CVE-2026-125172"],"related":[],"title":"FFmpeg: crafted EVC media file reads past packet buffer","description":"FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in libxevd_receive_frame() in libavcodec/libxevd.c that fails to validate NAL unit length prefixes against remaining packet data. Attackers can supply crafted EVC media with oversized 4-byte NAL length prefixes, causing libxevd to read past the packet buffer, crashing the application or exposing adjacent heap memory.","summary":"FFmpeg's libxevd decoder fails to check NAL unit length prefixes in EVC video, so a crafted file makes it read beyond the packet buffer. An attacker can crash the application or expose nearby heap memory.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ffmpeg","media-processing","package"],"not_affected_if":["no-evc-decoding","trusted-media-only"],"how_to_check":"- Run `ffmpeg -version` to see the installed version, and compare it with the affected range through 9.0.2.\n- Check whether the build includes the libxevd decoder (EVC support) with `ffmpeg -decoders | grep -i evc`.","fix":null,"status":"open","published_at":"2026-11-09T19:16:52+00:00","first_seen_at":"2026-11-09T19:28:16+00:00","triaged_at":"2026-11-09T19:30:19+00:00","updated_at":"2026-11-09T19:30:19+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-09T19:30:19Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"unknown","title":"FFmpeg: crafted EVC media file reads past packet buffer","impact":"low","summary":"FFmpeg's libxevd decoder fails to check NAL unit length prefixes in EVC video, so a crafted file makes it read beyond the packet buffer. An attacker can crash the application or expose nearby heap memory.","audience":"businesses","category":"package","nicknames":[],"who_cares":["ffmpeg","media-processing"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"crash of the process, or leak of adjacent heap memory","analyst_note":"Confirm the fixed FFmpeg version and whether the libxevd decoder is built by default, using the linked GitHub patch and the vulncheck advisory.","how_to_check":"- Run `ffmpeg -version` to see the installed version, and compare it with the affected range through 9.0.2.\n- Check whether the build includes the libxevd decoder (EVC support) with `ffmpeg -decoders | grep -i evc`.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-evc-decoding","trusted-media-only"],"who_is_affected":"Systems that run FFmpeg to decode untrusted EVC video, for example media ingestion or transcoding services that accept user uploads. Systems that never decode EVC content or only process trusted media are unlikely to be exposed. The sources do not state a fixed version.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000742,"input_tokens":4651,"output_tokens":554,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125172':12A,15A '-2026':11A,14A '4':94C '9.0.2':59C 'adjac':112C 'applic':51B,109C 'attack':47B,86C 'beyond':42B 'bound':65C 'buffer':9A,45B,106C 'byte':95C 'caus':99C 'check':27B 'contain':60C 'craft':2A,37B,89C 'crash':49B,107C 'cve':10A,13A 'data':85C 'decod':24B 'evc':3A,33B,90C 'expos':53B,111C 'fail':25B,75C 'ffmpeg':1A,16B,21B,57C 'file':5A,38B 'frame':71C 'heap':55B,113C 'length':30B,80C,97C 'libavcodec/libxevd.c':73C 'libxevd':23B,69C,100C 'make':39B 'media':4A,18B,91C 'media-process':17B 'memori':56B,114C 'nal':28B,78C,96C 'nearbi':54B 'out-of-bound':62C 'overs':93C 'packag':20B 'packet':8A,44B,84C,105C 'past':7A,103C 'prefix':31B,81C,98C 'process':19B 'read':6A,41B,66C,102C 'receiv':70C 'remain':83C 'suppli':88C 'unit':29B,79C 'valid':77C 'video':34B 'vulner':67C","nicknames":[],"mitigations":[],"who_affected":"Systems that run FFmpeg to decode untrusted EVC video, for example media ingestion or transcoding services that accept user uploads. Systems that never decode EVC content or only process trusted media are unlikely to be exposed. The sources do not state a fixed version.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ffmpeg","mediaprocessing","medium","package"],"campaign_type":null,"search_a":"'-125172':12A,15A '-2026':11A,14A 'buffer':9A 'craft':2A 'cve':10A,13A 'evc':3A 'ffmpeg':1A 'file':5A 'media':4A 'packet':8A 'past':7A 'read':6A","search_b":"'applic':51B 'attack':47B 'beyond':42B 'buffer':45B 'check':27B 'craft':37B 'crash':49B 'decod':24B 'evc':33B 'expos':53B 'fail':25B 'ffmpeg':16B,21B 'file':38B 'heap':55B 'length':30B 'libxevd':23B 'make':39B 'media':18B 'media-process':17B 'memori':56B 'nal':28B 'nearbi':54B 'packag':20B 'packet':44B 'prefix':31B 'process':19B 'read':41B 'unit':29B 'video':34B","search_c":"'4':94C '9.0.2':59C 'adjac':112C 'applic':109C 'attack':86C 'bound':65C 'buffer':106C 'byte':95C 'caus':99C 'contain':60C 'craft':89C 'crash':107C 'data':85C 'evc':90C 'expos':111C 'fail':75C 'ffmpeg':57C 'frame':71C 'heap':113C 'length':80C,97C 'libavcodec/libxevd.c':73C 'libxevd':69C,100C 'media':91C 'memori':114C 'nal':78C,96C 'out-of-bound':62C 'overs':93C 'packet':84C,105C 'past':103C 'prefix':81C,98C 'read':66C,102C 'receiv':70C 'remain':83C 'suppli':88C 'unit':79C 'valid':77C 'vulner':67C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T19:16:52+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125172","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125172","severity":null,"published_at":"2026-11-09T19:16:52+00:00","modified_at":"2026-11-09T19:16:52+00:00","first_seen_at":"2026-11-09T19:28:16+00:00","fetched_at":"2026-11-09T19:28:16+00:00","note":null}],"documents":[{"id":109231,"url":"https://github.com/FFmpeg/FFmpeg/commit/e06b3953d4253f8b56271628ba4083fde96aeadb","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109232,"url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-out-of-bounds-read-via-libxevd-evc-nal-length","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}