CVE-2026-125246

MediumCVSS 4.7/10Last modified Nov 10, 2026

Description

FFmpeg through 9.0.2 contains a denial of service vulnerability in cbs_jpeg_assemble_fragment() that miscounts 0xff stuffing bytes in JPEG scan headers. Attackers can supply a crafted JPEG/MJPEG stream with 0xff in the scan header, triggering an av_assert0 abort when CBS-based bitstream filters process it.

Metrics

CVSS 3.1 4.7/10CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-617

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
FFmpegFFmpeg<= 9.0.2

References

Timeline

Published
Nov 9, 2026
Last modified
Nov 10, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-1252473.3FFmpeg through 9.0.2 contains an integer overflow vulnerability in dng_decode_tiles() that allows attackers to leak uninitialized memory viaCVE-2026-1252487.0FFmpeg 9.0 through 9.0.2 contains an integer overflow vulnerability in libavcodec/ffv1enc_vulkan.c that undersizes the float remap GPU buffeCVE-2026-1252497.0FFmpeg 7.1 through 9.0.2 contains an integer overflow in ff_vk_decode_add_slice() in libavcodec/vulkan_decode.c that miscalculates the VulkaCVE-2026-125258.8The Redux Framework WordPress plugin before 4.5.13 does not restrict which user meta keys can be written when saving custom profile fields, CVE-2026-1252507.8FFmpeg through 9.0.2 contains a heap buffer overflow in the GIF encoder's gif_image_write_image() in libavcodec/gif.c because shrunk_buf is CVE-2026-1252517.0FFmpeg through 9.0.2 contains an integer overflow vulnerability in the VVC decoder alloc_frame() function in libavcodec/vvc/refs.c that undeCVE-2026-1252524.7FFmpeg through 9.0.2 contains a memory leak vulnerability in libavcodec/vaapi_decode.c that allows attackers to exhaust memory by supplying CVE-2026-1252535.3FFmpeg through 9.0.2 contains an integer overflow in cbs_vp9_split_fragment() in libavcodec/cbs_vp9.c that wraps the superframe size check oCVE-2026-1252545.5FFmpeg through 9.0.2 contains a division by zero vulnerability in the VVC decoder because ff_vvc_slice_rpl() fails to validate num_ref_idx_aCVE-2026-1252555.3FFmpeg through 9.0.2 contains a use after free vulnerability in libavcodec/mjpegdec.c that allows attackers to trigger freed buffer reads byCVE-2026-1252567.0FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in ff_llvidenc_diff_bytes_rvv() that allows attackers to corrupt heap memCVE-2026-1252577.0FFmpeg through 9.0.2 contains an off-by-one heap overflow vulnerability in get_exponent_dynamic() in libavcodec/nellymoserenc.c that allows
CVE-2026-125246: Medium severity, CVSS 4.7 | Vulnix