CVE-2026-125234 · Package
NO FIX YET
FFmpeg's WavPack encoder computes a block size from sample rate and channel count with an integer overflow, which can cause an infinite loop. A crafted audio file with a large declared sample rate and many channels can hang an application that transcodes it to WavPack.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications that use FFmpeg's libavcodec to transcode audio into WavPack and accept untrusted input files are exposed to a hang. The sources describe a denial of service (infinite loop) rather than code execution. Systems that do not encode WavPack, or that only process trusted files, are less exposed.
Not affected if no-wavpack-encoding, trusted-input-only
Who cares audio-transcoding, ffmpeg, libavcodec, wavpack
ffmpeg -version; the sources say the flaw affects versions through 9.0.2.No fix yet, per the sources.
FFmpeg through 9.0.2 contains an integer overflow vulnerability in wavpack_encode_init() in libavcodec/wavpackenc.c that causes an infinite loop when computing block size from sample rate and channel count. Attackers can supply a crafted audio file, such as a WAV header declaring a huge sample rate with many channels, to hang applications transcoding to WavPack.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.