CVE-2026-125258

FFmpeg through 9.0.2 contains a division by zero vulnerability in dovi configure ext() in libavcodec/dovi rpuenc.c that allows attackers to crash the process via an unvalidated frame rate denominator. Attackers can supply a crafted HEVC or AV1 input with a nonzero frame rate numerator and zero denominator to the dovi rpu bitstream filter or libx265, libaom, or libsvtav1 encoders, causing denial of service.