CVE-2026-125232 · Runtime
NO FIX YET · SEE WHAT TO DO
FFmpeg through 9.0.2 truncates frame timestamp distances to 16 bits in estimate_motion_b() in libavcodec, so a division by zero occurs. An attacker who supplies input with timestamp gaps that are multiples of 65536 can crash MPEG-4 Part 2 or MPEG-1/2 B-frame encoding with SIGFPE.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Systems that run FFmpeg to encode MPEG-4 Part 2 or MPEG-1/2 video from input that users or other parties can influence, such as transcoding services. Installations that only process trusted media or do not use these encoders are less exposed. The sources do not state the exact fixed version.
Not affected if encoders-unused, no-untrusted-input
Who cares ffmpeg, media-processing, transcoding
ffmpeg -version; the sources say it affects versions through 9.0.2.FFmpeg through 9.0.2 contains a division by zero vulnerability in estimate_motion_b() in libavcodec/motion_est.c, caused by frame timestamp distances truncated to 16 bits. Attackers can supply input with timestamp gaps that are multiples of 65536, crashing MPEG-4 Part 2 or MPEG-1/2 B-frame encoding with SIGFPE.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.