{"id":"CVE-2026-125183","kind":"vulnerability","aliases":["CVE-2026-125183"],"related":[],"title":"FFmpeg: crafted HEVC file stalls decoders and ffprobe via CPU exhaustion","description":"FFmpeg through 9.0.2 contains a denial of service vulnerability in pps_3d_extension() in libavcodec/hevc/ps.c that allows attackers to exhaust CPU through unbounded depth lookup table loops. Attackers can supply crafted HEVC files with repeated PPS NAL units that trigger hundreds of millions of bit skips, stalling decoders, parsers, and ffprobe.","summary":"FFmpeg through 9.0.2 has a flaw in the HEVC parameter set parser (pps_3d_extension in libavcodec/hevc/ps.c) where unbounded loops run on crafted input. An attacker who supplies a malicious HEVC file with repeated PPS NAL units can exhaust CPU and stall decoders, parsers and ffprobe.","severity":"medium","cvss":6.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ffmpeg","hevc","libavcodec","media-processing","runtime"],"not_affected_if":["no-untrusted-hevc-input"],"how_to_check":"- Run `ffmpeg -version` to see the installed FFmpeg version and compare it with the fixed release.\n- Check whether your service decodes or probes untrusted HEVC/H.265 uploads with FFmpeg, ffprobe or libavcodec.","fix":null,"status":"open","published_at":"2026-11-09T19:16:53+00:00","first_seen_at":"2026-11-09T19:28:17+00:00","triaged_at":"2026-11-09T19:31:34+00:00","updated_at":"2026-11-09T19:31:34+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-09T19:31:34Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"FFmpeg: crafted HEVC file stalls decoders and ffprobe via CPU exhaustion","impact":"low","summary":"FFmpeg through 9.0.2 has a flaw in the HEVC parameter set parser (pps_3d_extension in libavcodec/hevc/ps.c) where unbounded loops run on crafted input. An attacker who supplies a malicious HEVC file with repeated PPS NAL units can exhaust CPU and stall decoders, parsers and ffprobe.","audience":"developers","category":"runtime","nicknames":[],"who_cares":["ffmpeg","libavcodec","hevc","media-processing"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"CPU exhaustion stalls decoding and probing services","analyst_note":"Find the fixed FFmpeg version in the linked patch on github.com and confirm the affected range from the NVD entry.","how_to_check":"- Run `ffmpeg -version` to see the installed FFmpeg version and compare it with the fixed release.\n- Check whether your service decodes or probes untrusted HEVC/H.265 uploads with FFmpeg, ffprobe or libavcodec.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-untrusted-hevc-input"],"who_is_affected":"Systems that run FFmpeg, ffprobe or libavcodec on HEVC files from users or other untrusted sources are exposed to the stall. Pipelines that only process files you produce yourself are less exposed. The sources do not name a fixed version.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000767,"input_tokens":4643,"output_tokens":605,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125183':14A,17A '-2026':13A,16A '3d':38B,82C '9.0.2':27B,73C 'allow':87C 'attack':50B,88C,98C 'bit':115C 'contain':74C 'cpu':10A,64B,91C 'craft':2A,47B,101C 'cve':12A,15A 'decod':6A,67B,118C 'denial':76C 'depth':94C 'exhaust':11A,63B,90C 'extens':39B,83C 'ffmpeg':1A,18B,25B,71C 'ffprobe':8A,70B,121C 'file':4A,56B,103C 'flaw':30B 'hevc':3A,19B,33B,55B,102C 'hundr':111C 'input':48B 'libavcodec':20B 'libavcodec/hevc/ps.c':41B,85C 'lookup':95C 'loop':44B,97C 'malici':54B 'media':22B 'media-process':21B 'million':113C 'nal':60B,107C 'paramet':34B 'parser':36B,68B,119C 'pps':37B,59B,81C,106C 'process':23B 'repeat':58B,105C 'run':45B 'runtim':24B 'servic':78C 'set':35B 'skip':116C 'stall':5A,66B,117C 'suppli':52B,100C 'tabl':96C 'trigger':110C 'unbound':43B,93C 'unit':61B,108C 'via':9A 'vulner':79C","nicknames":[],"mitigations":[],"who_affected":"Systems that run FFmpeg, ffprobe or libavcodec on HEVC files from users or other untrusted sources are exposed to the stall. Pipelines that only process files you produce yourself are less exposed. The sources do not name a fixed version.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ffmpeg","hevc","libavcodec","mediaprocessing","medium","runtime"],"campaign_type":null,"search_a":"'-125183':14A,17A '-2026':13A,16A 'cpu':10A 'craft':2A 'cve':12A,15A 'decod':6A 'exhaust':11A 'ffmpeg':1A 'ffprobe':8A 'file':4A 'hevc':3A 'stall':5A 'via':9A","search_b":"'3d':38B '9.0.2':27B 'attack':50B 'cpu':64B 'craft':47B 'decod':67B 'exhaust':63B 'extens':39B 'ffmpeg':18B,25B 'ffprobe':70B 'file':56B 'flaw':30B 'hevc':19B,33B,55B 'input':48B 'libavcodec':20B 'libavcodec/hevc/ps.c':41B 'loop':44B 'malici':54B 'media':22B 'media-process':21B 'nal':60B 'paramet':34B 'parser':36B,68B 'pps':37B,59B 'process':23B 'repeat':58B 'run':45B 'runtim':24B 'set':35B 'stall':66B 'suppli':52B 'unbound':43B 'unit':61B","search_c":"'3d':82C '9.0.2':73C 'allow':87C 'attack':88C,98C 'bit':115C 'contain':74C 'cpu':91C 'craft':101C 'decod':118C 'denial':76C 'depth':94C 'exhaust':90C 'extens':83C 'ffmpeg':71C 'ffprobe':121C 'file':103C 'hevc':102C 'hundr':111C 'libavcodec/hevc/ps.c':85C 'lookup':95C 'loop':97C 'million':113C 'nal':107C 'parser':119C 'pps':81C,106C 'repeat':105C 'servic':78C 'skip':116C 'stall':117C 'suppli':100C 'tabl':96C 'trigger':110C 'unbound':93C 'unit':108C 'vulner':79C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T19:16:53+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125183","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125183","severity":null,"published_at":"2026-11-09T19:16:53+00:00","modified_at":"2026-11-09T19:16:53+00:00","first_seen_at":"2026-11-09T19:28:17+00:00","fetched_at":"2026-11-09T19:28:17+00:00","note":null}],"documents":[{"id":109256,"url":"https://github.com/FFmpeg/FFmpeg/commit/f9f732b444a2fc27dcc4fe52084d3d435f827864","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109257,"url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-denial-of-service-via-hevc-pps-3d-extension-parsing","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}