CVE-2026-125264 · Package
NO FIX YET
FFmpeg's JPEG XL frame header parser does not check table-of-contents entry counts against the remaining input. A crafted JPEG XL file with a huge TOC count makes the parser loop excessively and exhaust CPU, causing denial of service.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Systems that run FFmpeg (or libavcodec) and parse JPEG XL files supplied by outside users, such as media upload or conversion services. Installations that never process untrusted JPEG XL input are much less exposed.
Not affected if no-untrusted-jpeg-xl-input
Who cares ffmpeg, jpeg-xl, libavcodec, media-processing
ffmpeg -version; versions through 9.0.2 are listed as affected.No fix yet, per the sources.
FFmpeg through 9.0.2 contains an uncontrolled resource consumption vulnerability in parse_frame_header() in libavcodec/jpegxl_parser.c that fails to validate TOC entry counts against remaining input. Attackers can supply a crafted JPEG XL frame header with a permuted TOC and huge toc_count, making the parser loop excessively and exhaust CPU.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.