---
id: "CVE-2026-125183"
page: "https://infrastack.ai/live/CVE-2026-125183"
kind: "vulnerability"
aliases: ["CVE-2026-125183"]
title: "FFmpeg: crafted HEVC file stalls decoders and ffprobe via CPU exhaustion"
severity: "medium"
cvss: 6.8
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["ffmpeg", "hevc", "libavcodec", "media-processing", "runtime"]
not_affected_if: ["no-untrusted-hevc-input"]
published_at: "2026-11-09T19:16:53+00:00"
first_seen_at: "2026-11-09T19:28:17+00:00"
updated_at: "2026-11-09T19:31:34+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-125183", "first_seen_at": "2026-11-09T19:28:17+00:00"}]
exploit_sources: []
---

# FFmpeg: crafted HEVC file stalls decoders and ffprobe via CPU exhaustion

Link for people: https://infrastack.ai/live/CVE-2026-125183 (this .md is for agents)

FFmpeg through 9.0.2 has a flaw in the HEVC parameter set parser (pps_3d_extension in libavcodec/hevc/ps.c) where unbounded loops run on crafted input. An attacker who supplies a malicious HEVC file with repeated PPS NAL units can exhaust CPU and stall decoders, parsers and ffprobe.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `ffmpeg -version` to see the installed FFmpeg version and compare it with the fixed release.
- Check whether your service decodes or probes untrusted HEVC/H.265 uploads with FFmpeg, ffprobe or libavcodec.

## Timeline

- 2026-11-09T19:28:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-125183

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-denial-of-service-via-hevc-pps-3d-extension-parsing
- [fix] Patch: github.com https://github.com/FFmpeg/FFmpeg/commit/f9f732b444a2fc27dcc4fe52084d3d435f827864

## From the sources

FFmpeg through 9.0.2 contains a denial of service vulnerability in pps_3d_extension() in libavcodec/hevc/ps.c that allows attackers to exhaust CPU through unbounded depth lookup table loops. Attackers can supply crafted HEVC files with repeated PPS NAL units that trigger hundreds of millions of bit skips, stalling decoders, parsers, and ffprobe.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_