PT-2026-141017
CVE-2026-125189
·
Published
2026-11-09
·
Updated
2026-11-09
Description by
CVSS 3.1
4.7
MediumMetricsAV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
FFmpeg 8.1 through 9.0.2 contains a denial of service vulnerability in the lcevc metadata bitstream filter caused by a process block position mismatch in lcevc metadata handle vui(). Attackers can supply crafted LCEVC access units with two IDR or non-IDR NAL units to trigger an av assert0 failure in ff cbs lcevc list add(), aborting the application.
Found an issue in the description? Have something to add? Feel free to write us 👾