{"id":"CVE-2026-125264","kind":"vulnerability","aliases":["CVE-2026-125264"],"related":[],"title":"FFmpeg: crafted JPEG XL header can exhaust CPU during parsing","description":"FFmpeg through 9.0.2 contains an uncontrolled resource consumption vulnerability in parse_frame_header() in libavcodec/jpegxl_parser.c that fails to validate TOC entry counts against remaining input. Attackers can supply a crafted JPEG XL frame header with a permuted TOC and huge toc_count, making the parser loop excessively and exhaust CPU.","summary":"FFmpeg's JPEG XL frame header parser does not check table-of-contents entry counts against the remaining input. A crafted JPEG XL file with a huge TOC count makes the parser loop excessively and exhaust CPU, causing denial of service.","severity":"medium","cvss":6.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ffmpeg","jpeg-xl","libavcodec","media-processing","package"],"not_affected_if":["no-untrusted-jpeg-xl-input"],"how_to_check":"- Check the FFmpeg version with `ffmpeg -version`; versions through `9.0.2` are listed as affected.\n- Look for FFmpeg use that decodes or probes untrusted JPEG XL images, such as upload or thumbnail pipelines.","fix":null,"status":"open","published_at":"2026-11-09T20:18:12+00:00","first_seen_at":"2026-11-09T20:48:14+00:00","triaged_at":"2026-11-09T20:49:47+00:00","updated_at":"2026-11-09T20:49:47+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-09T20:49:47Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"FFmpeg: crafted JPEG XL header can exhaust CPU during parsing","impact":"low","summary":"FFmpeg's JPEG XL frame header parser does not check table-of-contents entry counts against the remaining input. A crafted JPEG XL file with a huge TOC count makes the parser loop excessively and exhaust CPU, causing denial of service.","audience":"businesses","category":"package","nicknames":[],"who_cares":["ffmpeg","libavcodec","media-processing","jpeg-xl"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker exhausts CPU, causing denial of service on the processing host.","analyst_note":"Confirm the fixed FFmpeg version and patch commit from the linked GitHub patch and NVD entry; sources give no fixed version.","how_to_check":"- Check the FFmpeg version with `ffmpeg -version`; versions through `9.0.2` are listed as affected.\n- Look for FFmpeg use that decodes or probes untrusted JPEG XL images, such as upload or thumbnail pipelines.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-untrusted-jpeg-xl-input"],"who_is_affected":"Systems that run FFmpeg (or libavcodec) and parse JPEG XL files supplied by outside users, such as media upload or conversion services. Installations that never process untrusted JPEG XL input are much less exposed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000748,"input_tokens":4626,"output_tokens":570,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125264':13A,16A '-2026':12A,15A '9.0.2':70C 'attack':93C 'caus':64B 'check':35B 'consumpt':75C 'contain':71C 'content':39B 'count':41B,55B,89C,109C 'cpu':8A,63B,117C 'craft':2A,47B,97C 'cve':11A,14A 'denial':65B 'entri':40B,88C 'excess':60B,114C 'exhaust':7A,62B,116C 'fail':84C 'ffmpeg':1A,17B,26B,68C 'file':50B 'frame':30B,79C,100C 'header':5A,31B,80C,101C 'huge':53B,107C 'input':45B,92C 'jpeg':3A,19B,28B,48B,98C 'jpeg-xl':18B 'libavcodec':21B 'libavcodec/jpegxl_parser.c':82C 'loop':59B,113C 'make':56B,110C 'media':23B 'media-process':22B 'packag':25B 'pars':10A,78C 'parser':32B,58B,112C 'permut':104C 'process':24B 'remain':44B,91C 'resourc':74C 'servic':67B 'suppli':95C 'tabl':37B 'table-of-cont':36B 'toc':54B,87C,105C,108C 'uncontrol':73C 'valid':86C 'vulner':76C 'xl':4A,20B,29B,49B,99C","nicknames":[],"mitigations":[],"who_affected":"Systems that run FFmpeg (or libavcodec) and parse JPEG XL files supplied by outside users, such as media upload or conversion services. Installations that never process untrusted JPEG XL input are much less exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ffmpeg","jpegxl","libavcodec","mediaprocessing","medium","package"],"campaign_type":null,"search_a":"'-125264':13A,16A '-2026':12A,15A 'cpu':8A 'craft':2A 'cve':11A,14A 'exhaust':7A 'ffmpeg':1A 'header':5A 'jpeg':3A 'pars':10A 'xl':4A","search_b":"'caus':64B 'check':35B 'content':39B 'count':41B,55B 'cpu':63B 'craft':47B 'denial':65B 'entri':40B 'excess':60B 'exhaust':62B 'ffmpeg':17B,26B 'file':50B 'frame':30B 'header':31B 'huge':53B 'input':45B 'jpeg':19B,28B,48B 'jpeg-xl':18B 'libavcodec':21B 'loop':59B 'make':56B 'media':23B 'media-process':22B 'packag':25B 'parser':32B,58B 'process':24B 'remain':44B 'servic':67B 'tabl':37B 'table-of-cont':36B 'toc':54B 'xl':20B,29B,49B","search_c":"'9.0.2':70C 'attack':93C 'consumpt':75C 'contain':71C 'count':89C,109C 'cpu':117C 'craft':97C 'entri':88C 'excess':114C 'exhaust':116C 'fail':84C 'ffmpeg':68C 'frame':79C,100C 'header':80C,101C 'huge':107C 'input':92C 'jpeg':98C 'libavcodec/jpegxl_parser.c':82C 'loop':113C 'make':110C 'pars':78C 'parser':112C 'permut':104C 'remain':91C 'resourc':74C 'suppli':95C 'toc':87C,105C,108C 'uncontrol':73C 'valid':86C 'vulner':76C 'xl':99C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T20:18:12+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125264","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125264","severity":null,"published_at":"2026-11-09T20:18:12+00:00","modified_at":"2026-11-09T20:18:12+00:00","first_seen_at":"2026-11-09T20:48:14+00:00","fetched_at":"2026-11-09T20:48:14+00:00","note":null}],"documents":[{"id":109740,"url":"https://github.com/FFmpeg/FFmpeg/commit/bc896c613ec0d4ad0108d62fbdda0196f69e7121","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109741,"url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-cpu-exhaustion-via-jpeg-xl-parser-toc-count","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}