CVE-2026-125231 · Package
NO FIX YET · SEE WHAT TO DO
FFmpeg's ADX/AAX decoder in libavcodec/adxdec.c updates the channel layout before validating the sample rate. A crafted stream with an invalid sample rate in mid-stream extradata makes the decoder write through NULL pointers, crashing the application.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications that link FFmpeg's libavcodec and decode ADX or AAX audio from untrusted sources are exposed. Systems that only decode trusted local media, or that do not use the ADX/AAX decoder, can skip it. The sources do not say whether the crash can be escalated beyond a denial of service.
Not affected if no-untrusted-adx-input, versions-outside-4.4-9.0.2
Who cares ffmpeg, libavcodec, media-processing
ffmpeg -version, and whether it falls in 4.4 through 9.0.2.FFmpeg 4.4 through 9.0.2 contains a NULL pointer dereference vulnerability in libavcodec/adxdec.c because adx_decode_header() updates the channel layout before validating the sample rate. Attackers can supply a crafted ADX/AAX stream with mid-stream new-extradata side data carrying an invalid sample rate, causing adx_decode() to write through NULL plane pointers and crash the application.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.