CVE-2026-125183 · Runtime
NO FIX YET
FFmpeg through 9.0.2 has a flaw in the HEVC parameter set parser (pps_3d_extension in libavcodec/hevc/ps.c) where unbounded loops run on crafted input. An attacker who supplies a malicious HEVC file with repeated PPS NAL units can exhaust CPU and stall decoders, parsers and ffprobe.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Systems that run FFmpeg, ffprobe or libavcodec on HEVC files from users or other untrusted sources are exposed to the stall. Pipelines that only process files you produce yourself are less exposed. The sources do not name a fixed version.
Not affected if no-untrusted-hevc-input
Who cares ffmpeg, hevc, libavcodec, media-processing
ffmpeg -version to see the installed FFmpeg version and compare it with the fixed release.No fix yet, per the sources.
FFmpeg through 9.0.2 contains a denial of service vulnerability in pps_3d_extension() in libavcodec/hevc/ps.c that allows attackers to exhaust CPU through unbounded depth lookup table loops. Attackers can supply crafted HEVC files with repeated PPS NAL units that trigger hundreds of millions of bit skips, stalling decoders, parsers, and ffprobe.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.