CVE-2026-125220

MediumCVSS 5.5/10Last modified Nov 10, 2026

Description

FFmpeg through 9.0.2 contains a deadlock vulnerability in mimic_decode_frame() in libavcodec/mimic.c that fails to report frame progress when init_get_bits8() fails. Attackers can supply a crafted file with an oversized Mimic intra frame followed by inter frames to hang frame-threaded decoding indefinitely.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-833

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
FFmpegFFmpeg<= 9.0.2

References

Timeline

Published
Nov 9, 2026
Last modified
Nov 10, 2026
NVD status
Undergoing Analysis

Related CVEs from 2026

CVE-2026-1252215.5FFmpeg through 9.0.2 contains an uncontrolled recursion vulnerability in score_header() in libavcodec/flac_parser.c that allows attackers toCVE-2026-1252227.0FFmpeg through 9.0.2 contains an integer overflow vulnerability in hap_parse_frame_header() in libavcodec/hapdec.c that allows attackers to CVE-2026-1252234.7FFmpeg 8.0 through 9.0.2 contains a memory leak vulnerability in the VP9 decoder that allows attackers to exhaust memory because vp9_decode_CVE-2026-1252245.5FFmpeg through 9.0.2 contains a denial of service vulnerability in libavcodec/vorbis_parser.c that re-parses invalid extradata for every pacCVE-2026-1252255.5FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in aac_adtstoasc_filter() that allows attackers to crash applicationsCVE-2026-1252265.5FFmpeg through 9.0.2 contains an uncontrolled memory allocation vulnerability in sbg_read_header() in libavformat/sbgdec.c that derives an uCVE-2026-1252277.0FFmpeg through 9.0.2 contains an integer overflow in cbs_jpeg_write_scan() in libavcodec/cbs_jpeg.c that causes a heap buffer overflow on 32CVE-2026-1252285.3FFmpeg before 8.1.3 and 9.x before 9.0.2 contains an out-of-bounds read vulnerability in put_vector() in libavcodec/vorbisenc.c when NaN samCVE-2026-1252297.8FFmpeg through 9.0.2 contains an out-of-bounds memory access vulnerability in the encode_frame() function of libavcodec/huffyuvenc.c, becausCVE-2026-125237.5Summary Cloudflare quiche's HTTP/3 layer was discovered to be vulnerable to resource exhaustion (i.e., memory) by means of specially crafCVE-2026-1252305.5FFmpeg through 9.0.2 contains an integer overflow vulnerability in the pcm_rechunk bitstream filter that allows attackers to trigger divisioCVE-2026-1252315.5FFmpeg 4.4 through 9.0.2 contains a NULL pointer dereference vulnerability in libavcodec/adxdec.c because adx_decode_header() updates the ch
CVE-2026-125220: Medium severity, CVSS 5.5 | Vulnix