CVE-2026-125230 · Runtime
NO FIX YET
FFmpeg's pcm_rechunk bitstream filter has an integer overflow that causes a division by zero when a file declares a huge channel count. An attacker who supplies such a file that is remuxed to MXF, GXF or DAUD can crash the application.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Systems that run FFmpeg on media files from untrusted sources and remux them into MXF, GXF or DAUD. Installations that only process trusted files or never use these output formats are less exposed. The sources do not state a fixed version beyond the affected range.
Not affected if trusted-input-only
Who cares ffmpeg, media-processing, self-hosted
ffmpeg -version and compare it to the affected range through 9.0.2No fix yet, per the sources.
FFmpeg through 9.0.2 contains an integer overflow vulnerability in the pcm_rechunk bitstream filter that allows attackers to trigger division by zero via a crafted channel count. Attackers can supply a file declaring a huge channel count that is remuxed into MXF, GXF or DAUD, overflowing sample_size and crashing the application.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.