{"id":"CVE-2026-125216","kind":"vulnerability","aliases":["CVE-2026-125216"],"related":[],"title":"FFmpeg: crafted 12-bit RGB image crashes DPX encoding with a NULL pointer","description":"FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in libavcodec/dpxenc.c that allows attackers to crash the process via unvalidated bits_per_raw_sample for RGB48 input. Attackers can supply a 12-bit RGB image, such as JPEG 2000, that when transcoded to DPX selects encode_gbrp12() and dereferences NULL plane pointers, causing denial of service.","summary":"FFmpeg's DPX encoder in libavcodec/dpxenc.c dereferences a NULL plane pointer when it transcodes a 12-bit RGB image, because bits_per_raw_sample is not validated for RGB48 input. An attacker who supplies such an image can crash the process, causing denial of service.","severity":"medium","cvss":6.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ffmpeg","media-processing","runtime","self-hosted"],"not_affected_if":["no-dpx-output","no-untrusted-input"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-09T19:16:58+00:00","first_seen_at":"2026-11-09T19:28:19+00:00","triaged_at":"2026-11-09T19:31:25+00:00","updated_at":"2026-11-09T19:31:25+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-09T19:31:25Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"FFmpeg: crafted 12-bit RGB image crashes DPX encoding with a NULL pointer","impact":"low","summary":"FFmpeg's DPX encoder in libavcodec/dpxenc.c dereferences a NULL plane pointer when it transcodes a 12-bit RGB image, because bits_per_raw_sample is not validated for RGB48 input. An attacker who supplies such an image can crash the process, causing denial of service.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["ffmpeg","media-processing","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Process crashes, causing denial of service for the transcoding service","analyst_note":"Confirm the fixed FFmpeg version and the patch commit from the linked github.com fix and the vulncheck advisory; the sources do not state a fixed version.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-untrusted-input","no-dpx-output"],"who_is_affected":"Systems that run FFmpeg to transcode untrusted images or media into DPX format are exposed, since the crash is triggered by the input. The sources do not state which FFmpeg versions are fixed beyond the affected range through 9.0.2. Deployments that never feed external images into the DPX encoder can deprioritize this.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000737,"input_tokens":4652,"output_tokens":543,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125216':16A,19A '-2026':15A,18A '12':3A,43B,104C '2000':111C '9.0.2':75C 'allow':85C 'attack':59B,86C,100C 'bit':4A,44B,48B,93C,105C 'caus':69B,125C 'contain':76C 'craft':2A 'crash':7A,66B,88C 'cve':14A,17A 'denial':70B,126C 'derefer':34B,80C,121C 'dpx':8A,30B,116C 'encod':9A,31B,118C 'ffmpeg':1A,20B,28B,73C 'gbrp12':119C 'host':27B 'imag':6A,46B,64B,107C 'input':57B,99C 'jpeg':110C 'libavcodec/dpxenc.c':33B,83C 'media':22B 'media-process':21B 'null':12A,36B,78C,122C 'per':49B,94C 'plane':37B,123C 'pointer':13A,38B,79C,124C 'process':23B,68B,90C 'raw':50B,95C 'rgb':5A,45B,106C 'rgb48':56B,98C 'runtim':24B 'sampl':51B,96C 'select':117C 'self':26B 'self-host':25B 'servic':72B,128C 'suppli':61B,102C 'transcod':41B,114C 'unvalid':92C 'valid':54B 'via':91C 'vulner':81C","nicknames":[],"mitigations":[],"who_affected":"Systems that run FFmpeg to transcode untrusted images or media into DPX format are exposed, since the crash is triggered by the input. The sources do not state which FFmpeg versions are fixed beyond the affected range through 9.0.2. Deployments that never feed external images into the DPX encoder can deprioritize this.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ffmpeg","mediaprocessing","medium","runtime","selfhosted"],"campaign_type":null,"search_a":"'-125216':16A,19A '-2026':15A,18A '12':3A 'bit':4A 'craft':2A 'crash':7A 'cve':14A,17A 'dpx':8A 'encod':9A 'ffmpeg':1A 'imag':6A 'null':12A 'pointer':13A 'rgb':5A","search_b":"'12':43B 'attack':59B 'bit':44B,48B 'caus':69B 'crash':66B 'denial':70B 'derefer':34B 'dpx':30B 'encod':31B 'ffmpeg':20B,28B 'host':27B 'imag':46B,64B 'input':57B 'libavcodec/dpxenc.c':33B 'media':22B 'media-process':21B 'null':36B 'per':49B 'plane':37B 'pointer':38B 'process':23B,68B 'raw':50B 'rgb':45B 'rgb48':56B 'runtim':24B 'sampl':51B 'self':26B 'self-host':25B 'servic':72B 'suppli':61B 'transcod':41B 'valid':54B","search_c":"'12':104C '2000':111C '9.0.2':75C 'allow':85C 'attack':86C,100C 'bit':93C,105C 'caus':125C 'contain':76C 'crash':88C 'denial':126C 'derefer':80C,121C 'dpx':116C 'encod':118C 'ffmpeg':73C 'gbrp12':119C 'imag':107C 'input':99C 'jpeg':110C 'libavcodec/dpxenc.c':83C 'null':78C,122C 'per':94C 'plane':123C 'pointer':79C,124C 'process':90C 'raw':95C 'rgb':106C 'rgb48':98C 'sampl':96C 'select':117C 'servic':128C 'suppli':102C 'transcod':114C 'unvalid':92C 'via':91C 'vulner':81C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T19:16:58+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125216","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125216","severity":null,"published_at":"2026-11-09T19:16:58+00:00","modified_at":"2026-11-09T19:16:58+00:00","first_seen_at":"2026-11-09T19:28:19+00:00","fetched_at":"2026-11-09T19:28:19+00:00","note":null}],"documents":[{"id":109323,"url":"https://github.com/FFmpeg/FFmpeg/commit/aa5fd7d287db4f469fdcbe444f7f9f38c8c289c7","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109324,"url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-dpx-encoder-null-pointer-dereference-via-encode-gbrp12","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}