PT-2026-141043

CVE-2026-125215

·

Published

2026-11-09

·

Updated

2026-11-09

Description by

CVSS 3.1
4.7
Medium
MetricsAV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
FFmpeg 7.1 through 9.0.2 contains a NULL pointer dereference vulnerability in ff dovi rpu generate() in libavcodec/dovi rpuenc.c that allows attackers to crash applications via crafted Dolby Vision RPU metadata. Attackers can supply streams with default or alternating omitted DM blocks to the dovi rpu bitstream filter with compression enabled, causing denial of service.
Exploitability
Fix
Impacts
Researchers
Vendors
Affected products
Weakness enumeration
CWE-476: NULL Pointer Dereference
Related identifiers
CVE-2026-125215
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com