CVE-2026-125246 · Package
NO FIX YET · SEE WHAT TO DO
FFmpeg through 9.0.2 miscounts 0xff stuffing bytes in JPEG scan headers in cbs_jpeg_assemble_fragment(). A crafted JPEG or MJPEG stream triggers an av_assert0 abort, so an attacker can crash any process that processes the file.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Systems that run FFmpeg on untrusted JPEG or MJPEG input through CBS-based bitstream filters can crash. Batch tools that only process files you produce yourself are unlikely to be exposed. unknown for exact configuration details.
Not affected if no-untrusted-media, not-using-cbs-filters
Who cares ffmpeg, media-processing, self-hosted
ffmpeg -versionFFmpeg through 9.0.2 contains a denial of service vulnerability in cbs_jpeg_assemble_fragment() that miscounts 0xff stuffing bytes in JPEG scan headers. Attackers can supply a crafted JPEG/MJPEG stream with 0xff in the scan header, triggering an av_assert0 abort when CBS-based bitstream filters process it.
This page as .md · .json · CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.