CVE-2026-125225 · Runtime
NO FIX YET
A crafted media file with an AAC packet over 256 MB makes FFmpeg dereference a NULL pointer in aac_adtstoasc_filter() during MP4, Matroska, FLV or LATM remuxing. An attacker can crash any application that processes such a file, causing denial of service.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Systems that run FFmpeg, or applications embedding it, to remux MP4, Matroska, FLV or LATM files from untrusted sources can be crashed by a crafted input. Services that only process trusted media or never remux AAC audio are less exposed. The sources do not list specific fixed versions.
Not affected if trusted-input-only
Who cares ffmpeg, media-processing
Unknown from the sources.
No fix yet, per the sources.
FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in aac_adtstoasc_filter() that allows attackers to crash applications via oversized ADTS AAC packets. Attackers can supply a crafted file with a packet over 256 MB, overflowing the bit count so init_get_bits() fails unchecked and get_bits() crashes during MP4, Matroska, FLV or LATM remuxing.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.