CVE-2026-125220 · Runtime
NO FIX YET
FFmpeg's Mimic video decoder fails to report frame progress when a frame is oversized, which can deadlock frame-threaded decoding. An attacker who supplies a crafted file can make decoding hang indefinitely, a denial of service.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Systems that run FFmpeg to decode untrusted Mimic-format video, especially with frame threading enabled, are exposed to a hang. Systems that only process trusted media or do not decode Mimic files can skip it. The sources do not state a fixed version.
Not affected if no-mimic-decoding, trusted-input-only
Who cares ffmpeg, media-processing, self-hosted
ffmpeg -version; versions through 9.0.2 are described as affected.No fix yet, per the sources.
FFmpeg through 9.0.2 contains a deadlock vulnerability in mimic_decode_frame() in libavcodec/mimic.c that fails to report frame progress when init_get_bits8() fails. Attackers can supply a crafted file with an oversized Mimic intra frame followed by inter frames to hang frame-threaded decoding indefinitely.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.