CVE-2026-125185 · Runtime
NO FIX YET
FFmpeg through 9.0.2 divides by zero in ff_aom_parse_film_grain_sets() when an AFGS1 film grain scaling point repeats an x value, because the parser does not reject it. An attacker who supplies a crafted HEVC or VVC file with zero-increment scaling points in T.35 SEI messages crashes the decoder.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Systems that run FFmpeg's decoder on HEVC or VVC files from untrusted sources, such as media upload or transcoding services, are exposed to a crash. Setups that only play local, trusted files are lower risk. The sources do not say whether a fixed FFmpeg release exists.
Not affected if trusted-input-only
Who cares ffmpeg, media-processing, video-transcoding
ffmpeg -version and compare against the fixed version in the patch link; the sources give no fixed version.No fix yet, per the sources.
FFmpeg through 9.0.2 contains a division by zero vulnerability in ff_aom_parse_film_grain_sets() that fails to reject AFGS1 scaling points with repeated x values. Attackers can supply crafted HEVC or VVC files with zero-increment scaling points in T.35 SEI messages, causing generate_scaling() to divide by zero and crash the decoder.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.