PT-2026-141044
CVE-2026-125216
·
Published
2026-11-09
·
Updated
2026-11-09
Description by
CVSS 3.1
5.5
MediumMetricsAV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in libavcodec/dpxenc.c that allows attackers to crash the process via unvalidated bits per raw sample for RGB48 input. Attackers can supply a 12-bit RGB image, such as JPEG 2000, that when transcoded to DPX selects encode gbrp12() and dereferences NULL plane pointers, causing denial of service.
Found an issue in the description? Have something to add? Feel free to write us 👾