CVE-2026-125215 · Package
NO FIX YET
FFmpeg's Dolby Vision RPU encoder dereferences a NULL pointer when a stream has omitted DM blocks and compression is enabled. An attacker who supplies a crafted stream can crash any application that processes it, causing denial of service.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Systems that run FFmpeg to process untrusted Dolby Vision video streams with the dovi_rpu bitstream filter and compression enabled. Services that only process trusted local media, or that do not use that filter, are less exposed.
Not affected if filter-unused, no-untrusted-input
Who cares dolby-vision, ffmpeg, video-processing
ffmpeg -version; affected releases are 7.1 through 9.0.2.dovi_rpu bitstream filter in applications that process untrusted video.No fix yet, per the sources.
FFmpeg 7.1 through 9.0.2 contains a NULL pointer dereference vulnerability in ff_dovi_rpu_generate() in libavcodec/dovi_rpuenc.c that allows attackers to crash applications via crafted Dolby Vision RPU metadata. Attackers can supply streams with default or alternating omitted DM blocks to the dovi_rpu bitstream filter with compression enabled, causing denial of service.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.