CVE-2026-125216 · Runtime
NO FIX YET
FFmpeg's DPX encoder in libavcodec/dpxenc.c dereferences a NULL plane pointer when it transcodes a 12-bit RGB image, because bits_per_raw_sample is not validated for RGB48 input. An attacker who supplies such an image can crash the process, causing denial of service.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Systems that run FFmpeg to transcode untrusted images or media into DPX format are exposed, since the crash is triggered by the input. The sources do not state which FFmpeg versions are fixed beyond the affected range through 9.0.2. Deployments that never feed external images into the DPX encoder can deprioritize this.
Not affected if no-dpx-output, no-untrusted-input
Who cares ffmpeg, media-processing, self-hosted
Unknown from the sources.
No fix yet, per the sources.
FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in libavcodec/dpxenc.c that allows attackers to crash the process via unvalidated bits_per_raw_sample for RGB48 input. Attackers can supply a 12-bit RGB image, such as JPEG 2000, that when transcoded to DPX selects encode_gbrp12() and dereferences NULL plane pointers, causing denial of service.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.