{"id":"CVE-2026-125224","kind":"vulnerability","aliases":["CVE-2026-125224"],"related":[],"title":"FFmpeg: crafted Vorbis streams make demuxing re-parse data and exhaust CPU","description":"FFmpeg through 9.0.2 contains a denial of service vulnerability in libavcodec/vorbis_parser.c that re-parses invalid extradata for every packet when valid_extradata remains false. Attackers can supply crafted Ogg or Matroska Vorbis streams with large invalid extradata and many packets to exhaust CPU during demuxing or probing.","summary":"FFmpeg through 9.0.2 re-parses invalid Vorbis extradata for every packet in libavcodec's vorbis parser. An attacker who supplies a crafted Ogg or Matroska file with large invalid extradata and many packets can exhaust CPU during demuxing or probing.","severity":"medium","cvss":6.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ffmpeg","libavcodec","media-processing","runtime"],"not_affected_if":["no-untrusted-media","trusted-input-only"],"how_to_check":"- Check the installed FFmpeg version with `ffmpeg -version` and compare it with the fixed release named in the patch link.\n- Find services that run FFmpeg or libavcodec on user-uploaded media (thumbnailing, transcoding, probing).","fix":null,"status":"open","published_at":"2026-11-09T19:16:59+00:00","first_seen_at":"2026-11-09T19:28:19+00:00","triaged_at":"2026-11-09T19:30:33+00:00","updated_at":"2026-11-09T19:30:33+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-09T19:30:33Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"FFmpeg: crafted Vorbis streams make demuxing re-parse data and exhaust CPU","impact":"low","summary":"FFmpeg through 9.0.2 re-parses invalid Vorbis extradata for every packet in libavcodec's vorbis parser. An attacker who supplies a crafted Ogg or Matroska file with large invalid extradata and many packets can exhaust CPU during demuxing or probing.","audience":"developers","category":"runtime","nicknames":[],"who_cares":["ffmpeg","libavcodec","media-processing"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker exhausts CPU, slowing or stalling media processing service","analyst_note":"Confirm the fixed FFmpeg version from the GitHub patch link and the VulnCheck advisory.","how_to_check":"- Check the installed FFmpeg version with `ffmpeg -version` and compare it with the fixed release named in the patch link.\n- Find services that run FFmpeg or libavcodec on user-uploaded media (thumbnailing, transcoding, probing).","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["trusted-input-only","no-untrusted-media"],"who_is_affected":"Systems that run FFmpeg or libavcodec on media files from outside sources, such as upload pipelines, transcoders or thumbnailers, are exposed to CPU exhaustion. Local tools used only on trusted files are low risk. The sources do not name the fixed version.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000755,"input_tokens":4624,"output_tokens":585,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125224':16A,19A '-2026':15A,18A '9.0.2':28B,69C 'attack':44B,92C 'contain':70C 'cpu':13A,62B,110C 'craft':2A,48B,95C 'cve':14A,17A 'data':10A 'demux':6A,64B,112C 'denial':72C 'everi':36B,85C 'exhaust':12A,61B,109C 'extradata':34B,56B,83C,89C,104C 'fals':91C 'ffmpeg':1A,20B,26B,67C 'file':52B 'invalid':32B,55B,82C,103C 'larg':54B,102C 'libavcodec':21B,39B 'libavcodec/vorbis_parser.c':77C 'make':5A 'mani':58B,106C 'matroska':51B,98C 'media':23B 'media-process':22B 'ogg':49B,96C 'packet':37B,59B,86C,107C 'pars':9A,31B,81C 'parser':42B 'probe':66B,114C 'process':24B 're':8A,30B,80C 're-pars':7A,29B,79C 'remain':90C 'runtim':25B 'servic':74C 'stream':4A,100C 'suppli':46B,94C 'valid':88C 'vorbi':3A,33B,41B,99C 'vulner':75C","nicknames":[],"mitigations":[],"who_affected":"Systems that run FFmpeg or libavcodec on media files from outside sources, such as upload pipelines, transcoders or thumbnailers, are exposed to CPU exhaustion. Local tools used only on trusted files are low risk. The sources do not name the fixed version.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ffmpeg","libavcodec","mediaprocessing","medium","runtime"],"campaign_type":null,"search_a":"'-125224':16A,19A '-2026':15A,18A 'cpu':13A 'craft':2A 'cve':14A,17A 'data':10A 'demux':6A 'exhaust':12A 'ffmpeg':1A 'make':5A 'pars':9A 're':8A 're-pars':7A 'stream':4A 'vorbi':3A","search_b":"'9.0.2':28B 'attack':44B 'cpu':62B 'craft':48B 'demux':64B 'everi':36B 'exhaust':61B 'extradata':34B,56B 'ffmpeg':20B,26B 'file':52B 'invalid':32B,55B 'larg':54B 'libavcodec':21B,39B 'mani':58B 'matroska':51B 'media':23B 'media-process':22B 'ogg':49B 'packet':37B,59B 'pars':31B 'parser':42B 'probe':66B 'process':24B 're':30B 're-pars':29B 'runtim':25B 'suppli':46B 'vorbi':33B,41B","search_c":"'9.0.2':69C 'attack':92C 'contain':70C 'cpu':110C 'craft':95C 'demux':112C 'denial':72C 'everi':85C 'exhaust':109C 'extradata':83C,89C,104C 'fals':91C 'ffmpeg':67C 'invalid':82C,103C 'larg':102C 'libavcodec/vorbis_parser.c':77C 'mani':106C 'matroska':98C 'ogg':96C 'packet':86C,107C 'pars':81C 'probe':114C 're':80C 're-pars':79C 'remain':90C 'servic':74C 'stream':100C 'suppli':94C 'valid':88C 'vorbi':99C 'vulner':75C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T19:16:59+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125224","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125224","severity":null,"published_at":"2026-11-09T19:16:59+00:00","modified_at":"2026-11-09T19:16:59+00:00","first_seen_at":"2026-11-09T19:28:19+00:00","fetched_at":"2026-11-09T19:28:19+00:00","note":null}],"documents":[{"id":109338,"url":"https://github.com/FFmpeg/FFmpeg/commit/90f5e61a1da2dcc0050169af8ca593530f26071b","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109339,"url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-vorbis-parser-cpu-exhaustion-via-invalid-extradata","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}