PT-2026-141053
CVE-2026-125225
·
Published
2026-11-09
·
Updated
2026-11-09
Description by
CVSS 3.1
5.5
MediumMetricsAV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in aac adtstoasc filter() that allows attackers to crash applications via oversized ADTS AAC packets. Attackers can supply a crafted file with a packet over 256 MB, overflowing the bit count so init get bits() fails unchecked and get bits() crashes during MP4, Matroska, FLV or LATM remuxing.
Found an issue in the description? Have something to add? Feel free to write us 👾