CVE-2026-125187 · Runtime
NO FIX YET
FFmpeg's TTA audio encoder fails to reserve space for a 4-byte CRC in its output packet. A crafted audio input can trigger an assertion that aborts the process transcoding to TTA, causing a denial of service.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications or services that transcode user-supplied audio to the TTA format using FFmpeg's libavcodec TTA encoder can crash when given a crafted input. Systems that do not encode TTA, or that do not accept untrusted audio, are unlikely to be exposed. The sources do not name a fixed version beyond the linked patch.
Not affected if no-tta-encoding, no-untrusted-audio
Who cares ffmpeg, libavcodec, media-transcoding
ffmpeg -version and compare against the fixed release in the sources-c:a tta)No fix yet, per the sources.
FFmpeg through 9.0.2 contains a reachable assertion vulnerability in the TTA encoder's tta_encode_frame() in libavcodec/ttaenc.c, which never reserves output packet space for the 4-byte CRC. Attackers can supply audio whose sample values and length produce a small, poorly compressible final frame, triggering the av_assert0() in flush_put_bits() and aborting applications transcoding to TTA.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.