{"id":"CVE-2026-125232","kind":"vulnerability","aliases":["CVE-2026-125232"],"related":[],"title":"FFmpeg: crafted timestamps crash B-frame encoding with a division by zero","description":"FFmpeg through 9.0.2 contains a division by zero vulnerability in estimate_motion_b() in libavcodec/motion_est.c, caused by frame timestamp distances truncated to 16 bits. Attackers can supply input with timestamp gaps that are multiples of 65536, crashing MPEG-4 Part 2 or MPEG-1/2 B-frame encoding with SIGFPE.","summary":"FFmpeg through 9.0.2 truncates frame timestamp distances to 16 bits in estimate_motion_b() in libavcodec, so a division by zero occurs. An attacker who supplies input with timestamp gaps that are multiples of 65536 can crash MPEG-4 Part 2 or MPEG-1/2 B-frame encoding with SIGFPE.","severity":"medium","cvss":6.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ffmpeg","media-processing","runtime","transcoding"],"not_affected_if":["encoders-unused","no-untrusted-input"],"how_to_check":"- Check the installed FFmpeg version with `ffmpeg -version`; the sources say it affects versions through `9.0.2`.\n- Look for services that run FFmpeg encoders on untrusted input, such as media upload or transcoding pipelines.","fix":"- Move to a FFmpeg release that includes the upstream patch; the exact fixed version is unknown from the sources.","status":"open","published_at":"2026-11-09T19:17:01+00:00","first_seen_at":"2026-11-09T19:28:20+00:00","triaged_at":"2026-11-09T19:30:28+00:00","updated_at":"2026-11-09T19:30:28+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-09T19:30:28Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a FFmpeg release that includes the upstream patch; the exact fixed version is unknown from the sources.","reach":"unknown","title":"FFmpeg: crafted timestamps crash B-frame encoding with a division by zero","impact":"low","summary":"FFmpeg through 9.0.2 truncates frame timestamp distances to 16 bits in estimate_motion_b() in libavcodec, so a division by zero occurs. An attacker who supplies input with timestamp gaps that are multiples of 65536 can crash MPEG-4 Part 2 or MPEG-1/2 B-frame encoding with SIGFPE.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["ffmpeg","media-processing","transcoding"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"Denial of service: the encoding process crashes on crafted input.","analyst_note":"Confirm the fixed FFmpeg version from the linked GitHub patch and the VulnCheck advisory.","how_to_check":"- Check the installed FFmpeg version with `ffmpeg -version`; the sources say it affects versions through `9.0.2`.\n- Look for services that run FFmpeg encoders on untrusted input, such as media upload or transcoding pipelines.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-untrusted-input","encoders-unused"],"who_is_affected":"Systems that run FFmpeg to encode MPEG-4 Part 2 or MPEG-1/2 video from input that users or other parties can influence, such as transcoding services. Installations that only process trusted media or do not use these encoders are less exposed. The sources do not state the exact fixed version.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000789,"input_tokens":4651,"output_tokens":647,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-1':69B,120C '-125232':16A,19A '-2026':15A,18A '-4':64B,115C '/2':70B,121C '16':34B,99C '2':66B,117C '65536':60B,112C '9.0.2':28B,79C 'attack':49B,101C 'b':6A,39B,72B,89C,123C 'b-frame':5A,71B,122C 'bit':35B,100C 'caus':92C 'contain':80C 'craft':2A 'crash':4A,62B,113C 'cve':14A,17A 'distanc':32B,96C 'divis':11A,44B,82C 'encod':8A,74B,125C 'estim':37B,87C 'ffmpeg':1A,20B,26B,77C 'frame':7A,30B,73B,94C,124C 'gap':55B,107C 'input':52B,104C 'libavcodec':41B 'libavcodec/motion_est.c':91C 'media':22B 'media-process':21B 'motion':38B,88C 'mpeg':63B,68B,114C,119C 'multipl':58B,110C 'occur':47B 'part':65B,116C 'process':23B 'runtim':24B 'sigfp':76B,127C 'suppli':51B,103C 'timestamp':3A,31B,54B,95C,106C 'transcod':25B 'truncat':29B,97C 'vulner':85C 'zero':13A,46B,84C","nicknames":[],"mitigations":[],"who_affected":"Systems that run FFmpeg to encode MPEG-4 Part 2 or MPEG-1/2 video from input that users or other parties can influence, such as transcoding services. Installations that only process trusted media or do not use these encoders are less exposed. The sources do not state the exact fixed version.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ffmpeg","mediaprocessing","medium","runtime","transcoding"],"campaign_type":null,"search_a":"'-125232':16A,19A '-2026':15A,18A 'b':6A 'b-frame':5A 'craft':2A 'crash':4A 'cve':14A,17A 'divis':11A 'encod':8A 'ffmpeg':1A 'frame':7A 'timestamp':3A 'zero':13A","search_b":"'-1':69B '-4':64B '/2':70B '16':34B '2':66B '65536':60B '9.0.2':28B 'attack':49B 'b':39B,72B 'b-frame':71B 'bit':35B 'crash':62B 'distanc':32B 'divis':44B 'encod':74B 'estim':37B 'ffmpeg':20B,26B 'frame':30B,73B 'gap':55B 'input':52B 'libavcodec':41B 'media':22B 'media-process':21B 'motion':38B 'mpeg':63B,68B 'multipl':58B 'occur':47B 'part':65B 'process':23B 'runtim':24B 'sigfp':76B 'suppli':51B 'timestamp':31B,54B 'transcod':25B 'truncat':29B 'zero':46B","search_c":"'-1':120C '-4':115C '/2':121C '16':99C '2':117C '65536':112C '9.0.2':79C 'attack':101C 'b':89C,123C 'b-frame':122C 'bit':100C 'caus':92C 'contain':80C 'crash':113C 'distanc':96C 'divis':82C 'encod':125C 'estim':87C 'ffmpeg':77C 'frame':94C,124C 'gap':107C 'input':104C 'libavcodec/motion_est.c':91C 'motion':88C 'mpeg':114C,119C 'multipl':110C 'part':116C 'sigfp':127C 'suppli':103C 'timestamp':95C,106C 'truncat':97C 'vulner':85C 'zero':84C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T19:17:01+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125232","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125232","severity":null,"published_at":"2026-11-09T19:17:01+00:00","modified_at":"2026-11-09T19:17:01+00:00","first_seen_at":"2026-11-09T19:28:20+00:00","fetched_at":"2026-11-09T19:28:20+00:00","note":null}],"documents":[{"id":109354,"url":"https://github.com/FFmpeg/FFmpeg/commit/16d19ccbce802634662a9bf18a5679cf27da2848","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109355,"url":"https://github.com/FFmpeg/FFmpeg/commit/bf0a2e4680df92d8de6514090d350152eb7845b8","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109356,"url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-division-by-zero-in-b-frame-motion-estimation","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}