{"id":"CVE-2026-125187","kind":"vulnerability","aliases":["CVE-2026-125187"],"related":[],"title":"FFmpeg: crafted audio makes TTA encoding abort the application","description":"FFmpeg through 9.0.2 contains a reachable assertion vulnerability in the TTA encoder's tta_encode_frame() in libavcodec/ttaenc.c, which never reserves output packet space for the 4-byte CRC. Attackers can supply audio whose sample values and length produce a small, poorly compressible final frame, triggering the av_assert0() in flush_put_bits() and aborting applications transcoding to TTA.","summary":"FFmpeg's TTA audio encoder fails to reserve space for a 4-byte CRC in its output packet. A crafted audio input can trigger an assertion that aborts the process transcoding to TTA, causing a denial of service.","severity":"medium","cvss":6.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ffmpeg","libavcodec","media-transcoding","runtime"],"not_affected_if":["no-tta-encoding","no-untrusted-audio"],"how_to_check":"- Run `ffmpeg -version` and compare against the fixed release in the sources\n- Check whether your pipeline transcodes audio to TTA (`-c:a tta`)","fix":null,"status":"open","published_at":"2026-11-09T19:16:54+00:00","first_seen_at":"2026-11-09T19:28:17+00:00","triaged_at":"2026-11-09T19:31:34+00:00","updated_at":"2026-11-09T19:31:34+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-09T19:31:34Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"FFmpeg: crafted audio makes TTA encoding abort the application","impact":"low","summary":"FFmpeg's TTA audio encoder fails to reserve space for a 4-byte CRC in its output packet. A crafted audio input can trigger an assertion that aborts the process transcoding to TTA, causing a denial of service.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["ffmpeg","libavcodec","media-transcoding"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Process aborts during TTA encoding, causing denial of service","analyst_note":"Confirm the fixed FFmpeg version from the linked GitHub patch and confirm the TTA-only trigger scope.","how_to_check":"- Run `ffmpeg -version` and compare against the fixed release in the sources\n- Check whether your pipeline transcodes audio to TTA (`-c:a tta`)\n- unknown for exact affected build ranges beyond 'through 9.0.2'","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-tta-encoding","no-untrusted-audio"],"who_is_affected":"Applications or services that transcode user-supplied audio to the TTA format using FFmpeg's libavcodec TTA encoder can crash when given a crafted input. Systems that do not encode TTA, or that do not accept untrusted audio, are unlikely to be exposed. The sources do not name a fixed version beyond the linked patch.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000754,"input_tokens":4644,"output_tokens":580,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125187':12A,15A '-2026':11A,14A '4':33B,86C '9.0.2':62C 'abort':7A,49B,114C 'applic':9A,115C 'assert':47B,66C 'assert0':108C 'attack':89C 'audio':3A,25B,42B,92C 'av':107C 'bit':112C 'byte':34B,87C 'caus':55B 'compress':102C 'contain':63C 'craft':2A,41B 'crc':35B,88C 'cve':10A,13A 'denial':57B 'encod':6A,26B,71C,74C 'fail':27B 'ffmpeg':1A,16B,22B,60C 'final':103C 'flush':110C 'frame':75C,104C 'input':43B 'length':97C 'libavcodec':17B 'libavcodec/ttaenc.c':77C 'make':4A 'media':19B 'media-transcod':18B 'never':79C 'output':38B,81C 'packet':39B,82C 'poor':101C 'process':51B 'produc':98C 'put':111C 'reachabl':65C 'reserv':29B,80C 'runtim':21B 'sampl':94C 'servic':59B 'small':100C 'space':30B,83C 'suppli':91C 'transcod':20B,52B,116C 'trigger':45B,105C 'tta':5A,24B,54B,70C,73C,118C 'valu':95C 'vulner':67C 'whose':93C","nicknames":[],"mitigations":[],"who_affected":"Applications or services that transcode user-supplied audio to the TTA format using FFmpeg's libavcodec TTA encoder can crash when given a crafted input. Systems that do not encode TTA, or that do not accept untrusted audio, are unlikely to be exposed. The sources do not name a fixed version beyond the linked patch.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ffmpeg","libavcodec","mediatranscoding","medium","runtime"],"campaign_type":null,"search_a":"'-125187':12A,15A '-2026':11A,14A 'abort':7A 'applic':9A 'audio':3A 'craft':2A 'cve':10A,13A 'encod':6A 'ffmpeg':1A 'make':4A 'tta':5A","search_b":"'4':33B 'abort':49B 'assert':47B 'audio':25B,42B 'byte':34B 'caus':55B 'craft':41B 'crc':35B 'denial':57B 'encod':26B 'fail':27B 'ffmpeg':16B,22B 'input':43B 'libavcodec':17B 'media':19B 'media-transcod':18B 'output':38B 'packet':39B 'process':51B 'reserv':29B 'runtim':21B 'servic':59B 'space':30B 'transcod':20B,52B 'trigger':45B 'tta':24B,54B","search_c":"'4':86C '9.0.2':62C 'abort':114C 'applic':115C 'assert':66C 'assert0':108C 'attack':89C 'audio':92C 'av':107C 'bit':112C 'byte':87C 'compress':102C 'contain':63C 'crc':88C 'encod':71C,74C 'ffmpeg':60C 'final':103C 'flush':110C 'frame':75C,104C 'length':97C 'libavcodec/ttaenc.c':77C 'never':79C 'output':81C 'packet':82C 'poor':101C 'produc':98C 'put':111C 'reachabl':65C 'reserv':80C 'sampl':94C 'small':100C 'space':83C 'suppli':91C 'transcod':116C 'trigger':105C 'tta':70C,73C,118C 'valu':95C 'vulner':67C 'whose':93C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T19:16:54+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125187","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125187","severity":null,"published_at":"2026-11-09T19:16:54+00:00","modified_at":"2026-11-09T19:16:54+00:00","first_seen_at":"2026-11-09T19:28:17+00:00","fetched_at":"2026-11-09T19:28:17+00:00","note":null}],"documents":[{"id":109264,"url":"https://github.com/FFmpeg/FFmpeg/commit/29a629e788c4343ff2e923095b8f38769fe2e470","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109265,"url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-tta-encoder-reachable-assertion-via-tta-encode-frame","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}