CVE-2026-125224 · Runtime
NO FIX YET
FFmpeg through 9.0.2 re-parses invalid Vorbis extradata for every packet in libavcodec's vorbis parser. An attacker who supplies a crafted Ogg or Matroska file with large invalid extradata and many packets can exhaust CPU during demuxing or probing.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Systems that run FFmpeg or libavcodec on media files from outside sources, such as upload pipelines, transcoders or thumbnailers, are exposed to CPU exhaustion. Local tools used only on trusted files are low risk. The sources do not name the fixed version.
Not affected if no-untrusted-media, trusted-input-only
Who cares ffmpeg, libavcodec, media-processing
ffmpeg -version and compare it with the fixed release named in the patch link.No fix yet, per the sources.
FFmpeg through 9.0.2 contains a denial of service vulnerability in libavcodec/vorbis_parser.c that re-parses invalid extradata for every packet when valid_extradata remains false. Attackers can supply crafted Ogg or Matroska Vorbis streams with large invalid extradata and many packets to exhaust CPU during demuxing or probing.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.