{"id":"CVE-2026-125230","kind":"vulnerability","aliases":["CVE-2026-125230"],"related":[],"title":"FFmpeg: crafted channel count in pcm_rechunk crashes the application","description":"FFmpeg through 9.0.2 contains an integer overflow vulnerability in the pcm_rechunk bitstream filter that allows attackers to trigger division by zero via a crafted channel count. Attackers can supply a file declaring a huge channel count that is remuxed into MXF, GXF or DAUD, overflowing sample_size and crashing the application.","summary":"FFmpeg's pcm_rechunk bitstream filter has an integer overflow that causes a division by zero when a file declares a huge channel count. An attacker who supplies such a file that is remuxed to MXF, GXF or DAUD can crash the application.","severity":"medium","cvss":6.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ffmpeg","media-processing","runtime","self-hosted"],"not_affected_if":["trusted-input-only"],"how_to_check":"- Check the installed FFmpeg version with `ffmpeg -version` and compare it to the affected range through 9.0.2\n- Find whether the pipeline remuxes untrusted media into MXF, GXF or DAUD with the pcm_rechunk filter","fix":null,"status":"open","published_at":"2026-11-09T19:17:00+00:00","first_seen_at":"2026-11-09T19:28:20+00:00","triaged_at":"2026-11-09T19:30:28+00:00","updated_at":"2026-11-09T19:30:28+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-09T19:30:28Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"FFmpeg: crafted channel count in pcm_rechunk crashes the application","impact":"low","summary":"FFmpeg's pcm_rechunk bitstream filter has an integer overflow that causes a division by zero when a file declares a huge channel count. An attacker who supplies such a file that is remuxed to MXF, GXF or DAUD can crash the application.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["ffmpeg","media-processing","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Application crashes from a division by zero on crafted input","analyst_note":"Confirm the fixed version and whether the pcm_rechunk flaw is reachable by default, using the linked patch and the vulncheck advisory.","how_to_check":"- Check the installed FFmpeg version with `ffmpeg -version` and compare it to the affected range through 9.0.2\n- Find whether the pipeline remuxes untrusted media into MXF, GXF or DAUD with the pcm_rechunk filter","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["trusted-input-only"],"who_is_affected":"Systems that run FFmpeg on media files from untrusted sources and remux them into MXF, GXF or DAUD. Installations that only process trusted files or never use these output formats are less exposed. The sources do not state a fixed version beyond the affected range.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000741,"input_tokens":4616,"output_tokens":558,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125230':13A,16A '-2026':12A,15A '9.0.2':70C 'allow':83C 'applic':10A,67B,119C 'attack':50B,84C,95C 'bitstream':29B,80C 'caus':36B 'channel':3A,47B,93C,103C 'contain':71C 'count':4A,48B,94C,104C 'craft':2A,92C 'crash':8A,65B,117C 'cve':11A,14A 'daud':63B,112C 'declar':44B,100C 'divis':38B,87C 'ffmpeg':1A,17B,25B,68C 'file':43B,55B,99C 'filter':30B,81C 'gxf':61B,110C 'host':24B 'huge':46B,102C 'integ':33B,73C 'media':19B 'media-process':18B 'mxf':60B,109C 'overflow':34B,74C,113C 'pcm':6A,27B,78C 'process':20B 'rechunk':7A,28B,79C 'remux':58B,107C 'runtim':21B 'sampl':114C 'self':23B 'self-host':22B 'size':115C 'suppli':52B,97C 'trigger':86C 'via':90C 'vulner':75C 'zero':40B,89C","nicknames":[],"mitigations":[],"who_affected":"Systems that run FFmpeg on media files from untrusted sources and remux them into MXF, GXF or DAUD. Installations that only process trusted files or never use these output formats are less exposed. The sources do not state a fixed version beyond the affected range.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ffmpeg","mediaprocessing","medium","runtime","selfhosted"],"campaign_type":null,"search_a":"'-125230':13A,16A '-2026':12A,15A 'applic':10A 'channel':3A 'count':4A 'craft':2A 'crash':8A 'cve':11A,14A 'ffmpeg':1A 'pcm':6A 'rechunk':7A","search_b":"'applic':67B 'attack':50B 'bitstream':29B 'caus':36B 'channel':47B 'count':48B 'crash':65B 'daud':63B 'declar':44B 'divis':38B 'ffmpeg':17B,25B 'file':43B,55B 'filter':30B 'gxf':61B 'host':24B 'huge':46B 'integ':33B 'media':19B 'media-process':18B 'mxf':60B 'overflow':34B 'pcm':27B 'process':20B 'rechunk':28B 'remux':58B 'runtim':21B 'self':23B 'self-host':22B 'suppli':52B 'zero':40B","search_c":"'9.0.2':70C 'allow':83C 'applic':119C 'attack':84C,95C 'bitstream':80C 'channel':93C,103C 'contain':71C 'count':94C,104C 'craft':92C 'crash':117C 'daud':112C 'declar':100C 'divis':87C 'ffmpeg':68C 'file':99C 'filter':81C 'gxf':110C 'huge':102C 'integ':73C 'mxf':109C 'overflow':74C,113C 'pcm':78C 'rechunk':79C 'remux':107C 'sampl':114C 'size':115C 'suppli':97C 'trigger':86C 'via':90C 'vulner':75C 'zero':89C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T19:17:00+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125230","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125230","severity":null,"published_at":"2026-11-09T19:17:00+00:00","modified_at":"2026-11-09T19:17:00+00:00","first_seen_at":"2026-11-09T19:28:20+00:00","fetched_at":"2026-11-09T19:28:20+00:00","note":null}],"documents":[{"id":109350,"url":"https://github.com/FFmpeg/FFmpeg/commit/11052ca4b01b021a135ec89ed7e86aa96dd3bf33","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109351,"url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-integer-overflow-division-by-zero-via-pcm-rechunk-filter","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}