CVE-2026-125189 · Package
NO FIX YET
FFmpeg 8.1 through 9.0.2 has a bug in the lcevc_metadata bitstream filter where a crafted LCEVC access unit with two IDR or non-IDR NAL units trips an assertion. The assertion aborts the process, so an attacker can cause a denial of service.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Only systems running FFmpeg 8.1 through 9.0.2 that apply the lcevc_metadata bitstream filter to untrusted media are exposed. Systems that never process LCEVC content or that use other FFmpeg versions can skip it. The sources do not say which fixed version to move to.
Not affected if no-lcevc-content, outside-affected-range, trusted-input-only
Who cares ffmpeg, media-processing, transcoding
ffmpeg -version and compare against the affected range 8.1 through 9.0.2.lcevc_metadata bitstream filter.No fix yet, per the sources.
FFmpeg 8.1 through 9.0.2 contains a denial of service vulnerability in the lcevc_metadata bitstream filter caused by a process block position mismatch in lcevc_metadata_handle_vui(). Attackers can supply crafted LCEVC access units with two IDR or non-IDR NAL units to trigger an av_assert0 failure in ff_cbs_lcevc_list_add(), aborting the application.
This page as .md · .json · CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.