CVE-2026-125258 · Package
NO FIX YET
FFmpeg through 9.0.2 divides by a frame rate denominator it never checks, so a crafted HEVC or AV1 input with a zero denominator crashes the process. An attacker gets denial of service, not code execution.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Systems that run FFmpeg to encode or process video from untrusted sources, especially through the dovi_rpu bitstream filter or the libx265, libaom or libsvtav1 encoders. Services that only process trusted, internally produced video can skip it.
Not affected if no-dovi-rpu-filter, trusted-input-only
Who cares ffmpeg, self-hosted, video-processing
ffmpeg -version and compare against the fixed release in the sourcesNo fix yet, per the sources.
FFmpeg through 9.0.2 contains a division by zero vulnerability in dovi_configure_ext() in libavcodec/dovi_rpuenc.c that allows attackers to crash the process via an unvalidated frame rate denominator. Attackers can supply a crafted HEVC or AV1 input with a nonzero frame rate numerator and zero denominator to the dovi_rpu bitstream filter or libx265, libaom, or libsvtav1 encoders, causing denial of service.
This page as .md · .json · CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.