{"id":"CVE-2026-125186","kind":"vulnerability","aliases":["CVE-2026-125186"],"related":[],"title":"FFmpeg: crafted H.264 packets exhaust CPU through dts2pts filter","description":"FFmpeg through 9.0.2 contains an uncontrolled resource consumption vulnerability in the dts2pts bitstream filter that allows attackers to exhaust CPU through unbounded per-packet POC node allocation. Attackers can supply a crafted H.264 packet with many slices of alternating picture order counts, forcing h264_queue_frame() to allocate tree nodes per slice and deny service.","summary":"FFmpeg through 9.0.2 has an uncontrolled resource consumption flaw in its dts2pts bitstream filter. A crafted H.264 packet with many slices forces unbounded per-slice memory and CPU allocation, letting an attacker cause a denial of service.","severity":"medium","cvss":5.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ffmpeg","h264","media-processing","package"],"not_affected_if":["no-untrusted-input"],"how_to_check":"- Run `ffmpeg -version` and compare against the fixed release named in the sources (unknown here)\n- Check whether the `dts2pts` bitstream filter is used in your pipelines (unknown if the sources do not say)","fix":null,"status":"open","published_at":"2026-11-09T19:16:54+00:00","first_seen_at":"2026-11-09T19:28:17+00:00","triaged_at":"2026-11-09T19:32:05+00:00","updated_at":"2026-11-09T19:32:05+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-09T19:32:05Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"FFmpeg: crafted H.264 packets exhaust CPU through dts2pts filter","impact":"low","summary":"FFmpeg through 9.0.2 has an uncontrolled resource consumption flaw in its dts2pts bitstream filter. A crafted H.264 packet with many slices forces unbounded per-slice memory and CPU allocation, letting an attacker cause a denial of service.","audience":"businesses","category":"package","nicknames":[],"who_cares":["ffmpeg","media-processing","h264"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker exhausts CPU, causing denial of service on the processing host","analyst_note":"Confirm the fixed version from the patch link (github.com) and the vulncheck advisory, and whether dts2pts is enabled by default.","how_to_check":"- Run `ffmpeg -version` and compare against the fixed release named in the sources (unknown here)\n- Check whether the `dts2pts` bitstream filter is used in your pipelines (unknown if the sources do not say)","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-untrusted-input"],"who_is_affected":"Systems that run FFmpeg to decode or process untrusted H.264 streams, such as media transcoding services or upload pipelines, are the ones to look at. The sources do not say which configurations trigger the dts2pts path, so a team that never feeds untrusted video to FFmpeg with that filter can likely skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000752,"input_tokens":4633,"output_tokens":578,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125186':12A,15A '-2026':11A,14A '9.0.2':24B,62C 'alloc':51B,87C,108C 'allow':75C 'altern':99C 'attack':54B,76C,88C 'bitstream':34B,72C 'caus':55B 'consumpt':29B,67C 'contain':63C 'count':102C 'cpu':6A,50B,79C 'craft':2A,37B,92C 'cve':10A,13A 'deni':114C 'denial':57B 'dts2pts':8A,33B,71C 'exhaust':5A,78C 'ffmpeg':1A,16B,22B,60C 'filter':9A,35B,73C 'flaw':30B 'forc':43B,103C 'frame':106C 'h.264':3A,38B,93C 'h264':17B,104C 'let':52B 'mani':41B,96C 'media':19B 'media-process':18B 'memori':48B 'node':86C,110C 'order':101C 'packag':21B 'packet':4A,39B,84C,94C 'per':46B,83C,111C 'per-packet':82C 'per-slic':45B 'pictur':100C 'poc':85C 'process':20B 'queue':105C 'resourc':28B,66C 'servic':59B,115C 'slice':42B,47B,97C,112C 'suppli':90C 'tree':109C 'unbound':44B,81C 'uncontrol':27B,65C 'vulner':68C","nicknames":[],"mitigations":[],"who_affected":"Systems that run FFmpeg to decode or process untrusted H.264 streams, such as media transcoding services or upload pipelines, are the ones to look at. The sources do not say which configurations trigger the dts2pts path, so a team that never feeds untrusted video to FFmpeg with that filter can likely skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ffmpeg","h264","mediaprocessing","medium","package"],"campaign_type":null,"search_a":"'-125186':12A,15A '-2026':11A,14A 'cpu':6A 'craft':2A 'cve':10A,13A 'dts2pts':8A 'exhaust':5A 'ffmpeg':1A 'filter':9A 'h.264':3A 'packet':4A","search_b":"'9.0.2':24B 'alloc':51B 'attack':54B 'bitstream':34B 'caus':55B 'consumpt':29B 'cpu':50B 'craft':37B 'denial':57B 'dts2pts':33B 'ffmpeg':16B,22B 'filter':35B 'flaw':30B 'forc':43B 'h.264':38B 'h264':17B 'let':52B 'mani':41B 'media':19B 'media-process':18B 'memori':48B 'packag':21B 'packet':39B 'per':46B 'per-slic':45B 'process':20B 'resourc':28B 'servic':59B 'slice':42B,47B 'unbound':44B 'uncontrol':27B","search_c":"'9.0.2':62C 'alloc':87C,108C 'allow':75C 'altern':99C 'attack':76C,88C 'bitstream':72C 'consumpt':67C 'contain':63C 'count':102C 'cpu':79C 'craft':92C 'deni':114C 'dts2pts':71C 'exhaust':78C 'ffmpeg':60C 'filter':73C 'forc':103C 'frame':106C 'h.264':93C 'h264':104C 'mani':96C 'node':86C,110C 'order':101C 'packet':84C,94C 'per':83C,111C 'per-packet':82C 'pictur':100C 'poc':85C 'queue':105C 'resourc':66C 'servic':115C 'slice':97C,112C 'suppli':90C 'tree':109C 'unbound':81C 'uncontrol':65C 'vulner':68C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T19:16:54+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125186","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125186","severity":null,"published_at":"2026-11-09T19:16:54+00:00","modified_at":"2026-11-09T19:16:54+00:00","first_seen_at":"2026-11-09T19:28:17+00:00","fetched_at":"2026-11-09T19:28:17+00:00","note":null}],"documents":[{"id":109262,"url":"https://github.com/FFmpeg/FFmpeg/commit/d8013c061725631261d7326c07d2af3a67fa4bc1","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109263,"url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-cpu-exhaustion-via-dts2pts-bitstream-filter","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}