CVE-2026-125238 · Runtime
NO FIX YET
FFmpeg's libxevd decoder hits an av_assert0() when an EVC file has truncated or picture-less access units, because it returns success without producing a frame. An attacker who supplies such a file makes any application decoding it abort.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications that run FFmpeg's libavcodec EVC decoding on files or streams from untrusted sources can be crashed by a crafted file. Systems that only decode trusted media, or builds without the libxevd decoder, are not exposed. The sources do not state a fixed version, though a patch link is listed.
Not affected if no-xevd-decoder, trusted-input-only
Who cares ffmpeg, libavcodec, media-pipelines, video-processing
ffmpeg -version and compare against the fixed release in the sources.ffmpeg -decoders | grep -i xevd.No fix yet, per the sources.
FFmpeg through 9.0.2 contains a reachable assertion vulnerability in libxevd_receive_frame() in libavcodec/libxevd.c that returns success when an access unit produces no frame. Attackers can supply a crafted EVC file with truncated or picture-less access units to trigger the av_assert0() on frame->private_ref, aborting any decoding application.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.