{"id":"CVE-2026-125189","kind":"vulnerability","aliases":["CVE-2026-125189"],"related":[],"title":"FFmpeg: crafted LCEVC stream crashes applications using the lcevc_metadata filter","description":"FFmpeg 8.1 through 9.0.2 contains a denial of service vulnerability in the lcevc_metadata bitstream filter caused by a process block position mismatch in lcevc_metadata_handle_vui(). Attackers can supply crafted LCEVC access units with two IDR or non-IDR NAL units to trigger an av_assert0 failure in ff_cbs_lcevc_list_add(), aborting the application.","summary":"FFmpeg 8.1 through 9.0.2 has a bug in the lcevc_metadata bitstream filter where a crafted LCEVC access unit with two IDR or non-IDR NAL units trips an assertion. The assertion aborts the process, so an attacker can cause a denial of service.","severity":"medium","cvss":5.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ffmpeg","media-processing","package","transcoding"],"not_affected_if":["no-lcevc-content","outside-affected-range","trusted-input-only"],"how_to_check":"- Run `ffmpeg -version` and compare against the affected range `8.1` through `9.0.2`.\n- Search your code and pipelines for use of the `lcevc_metadata` bitstream filter.","fix":null,"status":"open","published_at":"2026-11-09T19:16:54+00:00","first_seen_at":"2026-11-09T19:28:17+00:00","triaged_at":"2026-11-09T19:32:05+00:00","updated_at":"2026-11-09T19:32:05+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-09T19:32:05Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"FFmpeg: crafted LCEVC stream crashes applications using the lcevc_metadata filter","impact":"low","summary":"FFmpeg 8.1 through 9.0.2 has a bug in the lcevc_metadata bitstream filter where a crafted LCEVC access unit with two IDR or non-IDR NAL units trips an assertion. The assertion aborts the process, so an attacker can cause a denial of service.","audience":"businesses","category":"package","nicknames":[],"who_cares":["ffmpeg","media-processing","transcoding"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"Application process aborts, causing denial of service.","analyst_note":"Check the Patch link on github.com and the VulnCheck advisory for the fixed version and whether the lcevc_metadata filter is reachable by default.","how_to_check":"- Run `ffmpeg -version` and compare against the affected range `8.1` through `9.0.2`.\n- Search your code and pipelines for use of the `lcevc_metadata` bitstream filter.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["outside-affected-range","no-lcevc-content","trusted-input-only"],"who_is_affected":"Only systems running FFmpeg 8.1 through 9.0.2 that apply the lcevc_metadata bitstream filter to untrusted media are exposed. Systems that never process LCEVC content or that use other FFmpeg versions can skip it. The sources do not say which fixed version to move to.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000758,"input_tokens":4645,"output_tokens":587,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125189':14A,17A '-2026':13A,16A '8.1':25B,70C '9.0.2':27B,72C 'abort':57B,125C 'access':41B,102C 'add':124C 'applic':6A,127C 'assert':54B,56B 'assert0':117C 'attack':62B,97C 'av':116C 'bitstream':35B,83C 'block':89C 'bug':30B 'caus':64B,85C 'cbs':121C 'contain':73C 'craft':2A,39B,100C 'crash':5A 'cve':12A,15A 'denial':66B,75C 'failur':118C 'ff':120C 'ffmpeg':1A,18B,24B,69C 'filter':11A,36B,84C 'handl':95C 'idr':45B,49B,106C,110C 'lcevc':3A,9A,33B,40B,81C,93C,101C,122C 'list':123C 'media':20B 'media-process':19B 'metadata':10A,34B,82C,94C 'mismatch':91C 'nal':50B,111C 'non':48B,109C 'non-idr':47B,108C 'packag':22B 'posit':90C 'process':21B,59B,88C 'servic':68B,77C 'stream':4A 'suppli':99C 'transcod':23B 'trigger':114C 'trip':52B 'two':44B,105C 'unit':42B,51B,103C,112C 'use':7A 'vui':96C 'vulner':78C","nicknames":[],"mitigations":[],"who_affected":"Only systems running FFmpeg 8.1 through 9.0.2 that apply the lcevc_metadata bitstream filter to untrusted media are exposed. Systems that never process LCEVC content or that use other FFmpeg versions can skip it. The sources do not say which fixed version to move to.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ffmpeg","mediaprocessing","medium","package","transcoding"],"campaign_type":null,"search_a":"'-125189':14A,17A '-2026':13A,16A 'applic':6A 'craft':2A 'crash':5A 'cve':12A,15A 'ffmpeg':1A 'filter':11A 'lcevc':3A,9A 'metadata':10A 'stream':4A 'use':7A","search_b":"'8.1':25B '9.0.2':27B 'abort':57B 'access':41B 'assert':54B,56B 'attack':62B 'bitstream':35B 'bug':30B 'caus':64B 'craft':39B 'denial':66B 'ffmpeg':18B,24B 'filter':36B 'idr':45B,49B 'lcevc':33B,40B 'media':20B 'media-process':19B 'metadata':34B 'nal':50B 'non':48B 'non-idr':47B 'packag':22B 'process':21B,59B 'servic':68B 'transcod':23B 'trip':52B 'two':44B 'unit':42B,51B","search_c":"'8.1':70C '9.0.2':72C 'abort':125C 'access':102C 'add':124C 'applic':127C 'assert0':117C 'attack':97C 'av':116C 'bitstream':83C 'block':89C 'caus':85C 'cbs':121C 'contain':73C 'craft':100C 'denial':75C 'failur':118C 'ff':120C 'ffmpeg':69C 'filter':84C 'handl':95C 'idr':106C,110C 'lcevc':81C,93C,101C,122C 'list':123C 'metadata':82C,94C 'mismatch':91C 'nal':111C 'non':109C 'non-idr':108C 'posit':90C 'process':88C 'servic':77C 'suppli':99C 'trigger':114C 'two':105C 'unit':103C,112C 'vui':96C 'vulner':78C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T19:16:54+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125189","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125189","severity":null,"published_at":"2026-11-09T19:16:54+00:00","modified_at":"2026-11-09T19:16:54+00:00","first_seen_at":"2026-11-09T19:28:17+00:00","fetched_at":"2026-11-09T19:28:17+00:00","note":null}],"documents":[{"id":109269,"url":"https://github.com/FFmpeg/FFmpeg/commit/0747459f0c6f228566f5cb11ceed56b977208582","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109270,"url":"https://www.vulncheck.com/advisories/ffmpeg-8.1-through-9.0.2-denial-of-service-via-lcevc-metadata-bitstream-filter","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}