{"id":"CVE-2026-125221","kind":"vulnerability","aliases":["CVE-2026-125221"],"related":[],"title":"FFmpeg: crafted FLAC input exhausts stack and crashes the process","description":"FFmpeg through 9.0.2 contains an uncontrolled recursion vulnerability in score_header() in libavcodec/flac_parser.c that allows attackers to exhaust the thread stack via crafted FLAC input. Attackers can supply a FLAC stream packed with many small valid-looking frame headers, forcing deep recursion that crashes the process during demuxing or parsing.","summary":"FFmpeg through 9.0.2 recurses without limit in score_header() in the FLAC parser, so a crafted FLAC file exhausts the thread stack. An attacker who gets a program to demux the file can crash that process.","severity":"medium","cvss":6.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"FFmpeg","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["ffmpeg","media-processing","runtime","self-hosted"],"not_affected_if":["no-untrusted-flac-input","trusted-files-only"],"how_to_check":"- Run `ffmpeg -version` and compare against the fixed version in the patch linked from NVD.\n- Check whether any service accepts untrusted FLAC uploads and passes them to FFmpeg for demuxing or probing.","fix":"- FFmpeg: unknown (the sources name a patch on github.com but do not state the fixed version)","status":"open","published_at":"2026-11-09T19:16:59+00:00","first_seen_at":"2026-11-09T19:28:19+00:00","triaged_at":"2026-11-09T19:31:26+00:00","updated_at":"2026-11-09T19:31:26+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-09T19:31:26Z","model":"claude-haiku-5-5","output":{"fix":"- FFmpeg: unknown (the sources name a patch on github.com but do not state the fixed version)","reach":"internet","title":"FFmpeg: crafted FLAC input exhausts stack and crashes the process","impact":"low","summary":"FFmpeg through 9.0.2 recurses without limit in score_header() in the FLAC parser, so a crafted FLAC file exhausts the thread stack. An attacker who gets a program to demux the file can crash that process.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["ffmpeg","media-processing","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Attacker crashes the FFmpeg process by sending a crafted FLAC file","analyst_note":"Confirm the fixed FFmpeg version from the linked patch on github.com and the VulnCheck advisory, and whether it is a crash only or can lead to more.","how_to_check":"- Run `ffmpeg -version` and compare against the fixed version in the patch linked from NVD.\n- Check whether any service accepts untrusted FLAC uploads and passes them to FFmpeg for demuxing or probing.","plain_action":"","product_name":"FFmpeg","needs_analyst":true,"not_affected_if":["no-untrusted-flac-input","trusted-files-only"],"who_is_affected":"Systems that run FFmpeg's demuxer on FLAC files from untrusted sources, such as media upload, transcoding or thumbnail services. Desktop use on files you trust is much less exposed. Teams that never feed external audio to FFmpeg can skip it.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000774,"input_tokens":4630,"output_tokens":622,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125221':13A,16A '-2026':12A,15A '9.0.2':28B,64C 'allow':76C 'attack':49B,77C,87C 'contain':65C 'craft':2A,41B,84C 'crash':8A,59B,106C 'cve':11A,14A 'deep':103C 'demux':55B,110C 'exhaust':5A,44B,79C 'ffmpeg':1A,17A,18B,26B,62C 'file':43B,57B 'flac':3A,37B,42B,85C,91C 'forc':102C 'frame':100C 'get':51B 'header':34B,72C,101C 'host':25B 'input':4A,86C 'libavcodec/flac_parser.c':74C 'limit':31B 'look':99C 'mani':95C 'media':20B 'media-process':19B 'pack':93C 'pars':112C 'parser':38B 'process':10A,21B,61B,108C 'program':53B 'recurs':29B,68C,104C 'runtim':22B 'score':33B,71C 'self':24B 'self-host':23B 'small':96C 'stack':6A,47B,82C 'stream':92C 'suppli':89C 'thread':46B,81C 'uncontrol':67C 'valid':98C 'valid-look':97C 'via':83C 'vulner':69C 'without':30B","nicknames":[],"mitigations":[],"who_affected":"Systems that run FFmpeg's demuxer on FLAC files from untrusted sources, such as media upload, transcoding or thumbnail services. Desktop use on files you trust is much less exposed. Teams that never feed external audio to FFmpeg can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["ffmpeg"],"ptokens":["ffmpeg"],"labels":["ffmpeg","mediaprocessing","medium","runtime","selfhosted","vendor"],"campaign_type":null,"search_a":"'-125221':13A,16A '-2026':12A,15A 'craft':2A 'crash':8A 'cve':11A,14A 'exhaust':5A 'ffmpeg':1A,17A 'flac':3A 'input':4A 'process':10A 'stack':6A","search_b":"'9.0.2':28B 'attack':49B 'craft':41B 'crash':59B 'demux':55B 'exhaust':44B 'ffmpeg':18B,26B 'file':43B,57B 'flac':37B,42B 'get':51B 'header':34B 'host':25B 'limit':31B 'media':20B 'media-process':19B 'parser':38B 'process':21B,61B 'program':53B 'recurs':29B 'runtim':22B 'score':33B 'self':24B 'self-host':23B 'stack':47B 'thread':46B 'without':30B","search_c":"'9.0.2':64C 'allow':76C 'attack':77C,87C 'contain':65C 'craft':84C 'crash':106C 'deep':103C 'demux':110C 'exhaust':79C 'ffmpeg':62C 'flac':85C,91C 'forc':102C 'frame':100C 'header':72C,101C 'input':86C 'libavcodec/flac_parser.c':74C 'look':99C 'mani':95C 'pack':93C 'pars':112C 'process':108C 'recurs':68C,104C 'score':71C 'small':96C 'stack':82C 'stream':92C 'suppli':89C 'thread':81C 'uncontrol':67C 'valid':98C 'valid-look':97C 'via':83C 'vulner':69C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T19:16:59+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125221","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125221","severity":null,"published_at":"2026-11-09T19:16:59+00:00","modified_at":"2026-11-09T19:16:59+00:00","first_seen_at":"2026-11-09T19:28:19+00:00","fetched_at":"2026-11-09T19:28:19+00:00","note":null}],"documents":[{"id":109332,"url":"https://github.com/FFmpeg/FFmpeg/commit/972fe1ccd326538fe9a6b5d5094b7880b5443429","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109333,"url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-uncontrolled-recursion-in-flac-parser-score-header","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}