NULL Pointer Dereference Vulnerability in FFmpeg by FFmpeg
CVE-2026-125225

6.8MEDIUM

Key Information:

Vendor

Ffmpeg

Status
Ffmpeg
Vendor
CVE Published:
9 November 2026

What is CVE-2026-125225?

FFmpeg versions through 9.0.2 are susceptible to a NULL pointer dereference in the aac_adtstoasc_filter function. This vulnerability is triggered when an attacker provides oversized ADTS AAC packets, specifically those exceeding 256 MB. The inflated packet size can overflow the bit count leading to unchecked failures in init_get_bits(), which ultimately causes a crash in the get_bits() function during the remuxing process for MP4, Matroska, FLV, or LATM formats. This presents a risk for applications utilizing FFmpeg, especially when processing potentially malicious media files.

Affected Version(s)

FFmpeg 0 <= 9.0.2

References

https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25569
issue-tracking
https://github.com/FFmpeg/FFmpeg/commit/3b1cbb5e0f66b85d1...
patch
https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/b...
technical-description

CVSS V4

Score:
6.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Joshua Rogers (AISLE Research)
Michael Niedermayer
.