CVE-2026-125186 · Package
NO FIX YET
FFmpeg through 9.0.2 has an uncontrolled resource consumption flaw in its dts2pts bitstream filter. A crafted H.264 packet with many slices forces unbounded per-slice memory and CPU allocation, letting an attacker cause a denial of service.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Systems that run FFmpeg to decode or process untrusted H.264 streams, such as media transcoding services or upload pipelines, are the ones to look at. The sources do not say which configurations trigger the dts2pts path, so a team that never feeds untrusted video to FFmpeg with that filter can likely skip it.
Not affected if no-untrusted-input
Who cares ffmpeg, h264, media-processing
ffmpeg -version and compare against the fixed release named in the sources (unknown here)dts2pts bitstream filter is used in your pipelines (unknown if the sources do not say)No fix yet, per the sources.
FFmpeg through 9.0.2 contains an uncontrolled resource consumption vulnerability in the dts2pts bitstream filter that allows attackers to exhaust CPU through unbounded per-packet POC node allocation. Attackers can supply a crafted H.264 packet with many slices of alternating picture order counts, forcing h264_queue_frame() to allocate tree nodes per slice and deny service.
This page as .md · .json · CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.