{"id":"CVE-2026-125254","kind":"vulnerability","aliases":["CVE-2026-125254"],"related":[],"title":"FFmpeg: crafted VVC bitstream crashes the decoder via division by zero","description":"FFmpeg through 9.0.2 contains a division by zero vulnerability in the VVC decoder because ff_vvc_slice_rpl() fails to validate num_ref_idx_active against built reference list entries. Attackers can supply a crafted VVC bitstream whose excess reference indices yield a zero POC difference in ff_vvc_mv_scale(), crashing the decoding process.","summary":"FFmpeg through 9.0.2 has a division-by-zero bug in its VVC decoder, because reference list indices are not validated. A crafted VVC video file makes the decoding process crash.","severity":"medium","cvss":6.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ffmpeg","package","video-processing","vvc"],"not_affected_if":["no-vvc-decoding","trusted-input-only"],"how_to_check":"- Run `ffmpeg -version` and compare against the fixed release named in the sources.\n- Check whether your application decodes untrusted VVC (H.266) input with FFmpeg.","fix":null,"status":"open","published_at":"2026-11-09T20:18:11+00:00","first_seen_at":"2026-11-09T20:48:13+00:00","triaged_at":"2026-11-09T20:49:48+00:00","updated_at":"2026-11-09T20:49:48+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-09T20:49:48Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"FFmpeg: crafted VVC bitstream crashes the decoder via division by zero","impact":"low","summary":"FFmpeg through 9.0.2 has a division-by-zero bug in its VVC decoder, because reference list indices are not validated. A crafted VVC video file makes the decoding process crash.","audience":"businesses","category":"package","nicknames":[],"who_cares":["ffmpeg","video-processing","vvc"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"decoder process crashes on a crafted video file","analyst_note":"Confirm the first fixed FFmpeg version from the linked patch on github.com and the vulncheck advisory.","how_to_check":"- Run `ffmpeg -version` and compare against the fixed release named in the sources.\n- Check whether your application decodes untrusted VVC (H.266) input with FFmpeg.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-vvc-decoding","trusted-input-only"],"who_is_affected":"Systems that decode VVC bitstreams with FFmpeg, especially those that accept video from untrusted users or uploads. Pipelines that never decode VVC input are not exposed by this flaw. The sources do not name the fixed version; a patch is linked from the advisory references.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00072,"input_tokens":4632,"output_tokens":513,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125254':14A,17A '-2026':13A,16A '9.0.2':26B,57C 'activ':79C 'attack':85C 'bitstream':4A,91C 'bug':33B 'built':81C 'contain':58C 'craft':2A,46B,89C 'crash':5A,54B,106C 'cve':12A,15A 'decod':7A,37B,52B,67C,108C 'differ':100C 'divis':9A,30B,60C 'division-by-zero':29B 'entri':84C 'excess':93C 'fail':73C 'ff':69C,102C 'ffmpeg':1A,18B,24B,55C 'file':49B 'idx':78C 'indic':41B,95C 'list':40B,83C 'make':50B 'mv':104C 'num':76C 'packag':19B 'poc':99C 'process':22B,53B,109C 'ref':77C 'refer':39B,82C,94C 'rpl':72C 'scale':105C 'slice':71C 'suppli':87C 'valid':44B,75C 'via':8A 'video':21B,48B 'video-process':20B 'vulner':63C 'vvc':3A,23B,36B,47B,66C,70C,90C,103C 'whose':92C 'yield':96C 'zero':11A,32B,62C,98C","nicknames":[],"mitigations":[],"who_affected":"Systems that decode VVC bitstreams with FFmpeg, especially those that accept video from untrusted users or uploads. Pipelines that never decode VVC input are not exposed by this flaw. The sources do not name the fixed version; a patch is linked from the advisory references.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ffmpeg","medium","package","videoprocessing","vvc"],"campaign_type":null,"search_a":"'-125254':14A,17A '-2026':13A,16A 'bitstream':4A 'craft':2A 'crash':5A 'cve':12A,15A 'decod':7A 'divis':9A 'ffmpeg':1A 'via':8A 'vvc':3A 'zero':11A","search_b":"'9.0.2':26B 'bug':33B 'craft':46B 'crash':54B 'decod':37B,52B 'divis':30B 'division-by-zero':29B 'ffmpeg':18B,24B 'file':49B 'indic':41B 'list':40B 'make':50B 'packag':19B 'process':22B,53B 'refer':39B 'valid':44B 'video':21B,48B 'video-process':20B 'vvc':23B,36B,47B 'zero':32B","search_c":"'9.0.2':57C 'activ':79C 'attack':85C 'bitstream':91C 'built':81C 'contain':58C 'craft':89C 'crash':106C 'decod':67C,108C 'differ':100C 'divis':60C 'entri':84C 'excess':93C 'fail':73C 'ff':69C,102C 'ffmpeg':55C 'idx':78C 'indic':95C 'list':83C 'mv':104C 'num':76C 'poc':99C 'process':109C 'ref':77C 'refer':82C,94C 'rpl':72C 'scale':105C 'slice':71C 'suppli':87C 'valid':75C 'vulner':63C 'vvc':66C,70C,90C,103C 'whose':92C 'yield':96C 'zero':62C,98C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T20:18:11+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125254","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125254","severity":null,"published_at":"2026-11-09T20:18:11+00:00","modified_at":"2026-11-09T20:18:11+00:00","first_seen_at":"2026-11-09T20:48:13+00:00","fetched_at":"2026-11-09T20:48:13+00:00","note":null}],"documents":[{"id":109719,"url":"https://github.com/FFmpeg/FFmpeg/commit/8732d7585cd8ab9d1dd9baeb4db5e93466c0efa7","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109720,"url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-division-by-zero-via-vvc-ff-vvc-slice-rpl","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}