Reachable Assertion Vulnerability in FFmpeg by FFmpeg

CVE-2026-125238

What is CVE-2026-125238?

FFmpeg versions up to 9.0.2 are susceptible to a reachable assertion vulnerability found in the libxevd_receive_frame() function. Attackers can exploit this flaw by crafting specific EVC files containing truncated or picture-less access units. When these files are processed, they can trigger an assertion failure (av_assert0()) on frame->private_ref, leading to an abrupt termination of any decoding application that attempts to handle such files. This vulnerability exposes applications utilizing FFmpeg to potential denial-of-service conditions, highlighting the need for immediate updates to mitigate risks.

References