Integer Overflow in FFmpeg's pcm_rechunk Bitstream Filter
CVE-2026-125230

6.8MEDIUM

Key Information:

Vendor

Ffmpeg

Status
Ffmpeg
Vendor
CVE Published:
9 November 2026

What is CVE-2026-125230?

FFmpeg versions through 9.0.2 suffer from an integer overflow vulnerability found in the pcm_rechunk bitstream filter. This flaw enables attackers to manipulate media files, declaring an excessively large channel count which can lead to a division by zero error. This potentially results in the crashing of the application when processing remuxed files in MXF, GXF, or DAUD formats. Developers should take this vulnerability seriously and apply the necessary patches to safeguard their applications.

Affected Version(s)

FFmpeg 0 <= 9.0.2

References

https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25569
issue-tracking
https://github.com/FFmpeg/FFmpeg/commit/11052ca4b01b021a1...
patch
https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/b...
technical-description

CVSS V4

Score:
6.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Joshua Rogers (AISLE Research)
Michael Niedermayer
.