Linux Distros Unpatched Vulnerability : CVE-2026-125185

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FFmpeg through 9.0.2 contains a division by zero vulnerability in ffaomparsefilmgrainsets that fails to reject AFGS1 scaling points with repeated x values...

UBUNTU-CVE-2026-125185

FFmpeg through 9.0.2 contains a division by zero vulnerability in ffaomparsefilmgrainsets that fails to reject AFGS1 scaling points with repeated x values. Attackers can supply crafted HEVC or VVC files with zero-increment scaling points in T.35 SEI messages, causing generatescaling to divide by...

CVE-2026-125185

FFmpeg through 9.0.2 contains a division by zero vulnerability in ffaomparsefilmgrainsets that fails to reject AFGS1 scaling points with repeated x values. Attackers can supply crafted HEVC or VVC files with zero-increment scaling points in T.35 SEI messages, causing generatescaling to divide by...

CVE-2026-125185 FFmpeg through 9.0.2 Division by Zero via AFGS1 Film Grain Scaling Points

FFmpeg through 9.0.2 contains a division by zero vulnerability in ffaomparsefilmgrainsets that fails to reject AFGS1 scaling points with repeated x values. Attackers can supply crafted HEVC or VVC files with zero-increment scaling points in T.35 SEI messages, causing generatescaling to divide by...

CVE-2026-125185 FFmpeg through 9.0.2 Division by Zero via AFGS1 Film Grain Scaling Points

FFmpeg through 9.0.2 contains a division by zero vulnerability in ffaomparsefilmgrainsets that fails to reject AFGS1 scaling points with repeated x values. Attackers can supply crafted HEVC or VVC files with zero-increment scaling points in T.35 SEI messages, causing generatescaling to divide by...

EUVD-2026-120274

FFmpeg through 9.0.2 contains a division by zero vulnerability in ffaomparsefilmgrainsets that fails to reject AFGS1 scaling points with repeated x values. Attackers can supply crafted HEVC or VVC files with zero-increment scaling points in T.35 SEI messages, causing generatescaling to divide by...

SUSE CVE-2026-124308

Fraunhofer HHI VVdeC before 3.2.1 contains a heap use-after-free vulnerability in DecLibRecon::createSubPicRefBufs because decompressPicture clears msubPicExtTasks without waiting for pending tasks. Attackers can supply a crafted multi-subpicture VVC bitstream to decoders using two or more thread...

CVE-2026-125185: FFmpeg: FFmpeg through 9.0.2 contains a division by zero vulnerability in ff_aom_parse_film_grain_sets() that fails to reject…

FFmpeg through 9.0.2 contains a division by zero vulnerability in ffaomparsefilmgrainsets that fails to reject AFGS1 scaling points with repeated x values. Attackers can supply crafted HEVC or VVC files with zero-increment scaling points in T.35 SEI messages, causing generatescaling to divide by...

PT-2026-141013

FFmpeg through 9.0.2 contains a division by zero vulnerability in ff aom parse film grain sets that fails to reject AFGS1 scaling points with repeated x values. Attackers can supply crafted HEVC or VVC files with zero-increment scaling points in T.35 SEI messages, causing generate scaling to divi...

CVE-2026-124308

Fraunhofer HHI VVdeC before 3.2.1 contains a heap use-after-free vulnerability in DecLibRecon::createSubPicRefBufs because decompressPicture clears msubPicExtTasks without waiting for pending tasks. Attackers can supply a crafted multi-subpicture VVC bitstream to decoders using two or more thread...

EUVD-2026-119278

Fraunhofer HHI VVdeC before 3.2.1 contains a heap use-after-free vulnerability in DecLibRecon::createSubPicRefBufs because decompressPicture clears msubPicExtTasks without waiting for pending tasks. Attackers can supply a crafted multi-subpicture VVC bitstream to decoders using two or more thread...

CVE-2026-124308 Fraunhofer HHI VVdeC before 3.2.1 Use-After-Free via DecLibRecon::createSubPicRefBufs

Fraunhofer HHI VVdeC before 3.2.1 contains a heap use-after-free vulnerability in DecLibRecon::createSubPicRefBufs because decompressPicture clears msubPicExtTasks without waiting for pending tasks. Attackers can supply a crafted multi-subpicture VVC bitstream to decoders using two or more thread...

CVE-2026-124308 Fraunhofer HHI VVdeC before 3.2.1 Use-After-Free via DecLibRecon::createSubPicRefBufs

Fraunhofer HHI VVdeC before 3.2.1 contains a heap use-after-free vulnerability in DecLibRecon::createSubPicRefBufs because decompressPicture clears msubPicExtTasks without waiting for pending tasks. Attackers can supply a crafted multi-subpicture VVC bitstream to decoders using two or more thread...

CVE-2026-124308

Fraunhofer HHI VVdeC before 3.2.1 contains a heap use-after-free vulnerability in DecLibRecon::createSubPicRefBufs because decompressPicture clears msubPicExtTasks without waiting for pending tasks. Attackers can supply a crafted multi-subpicture VVC bitstream to decoders using two or more thread...

CVE-2026-124308 Fraunhofer HHI VVdeC before 3.2.1 Use-After-Free via DecLibRecon::createSubPicRefBufs

Fraunhofer HHI VVdeC before 3.2.1 contains a heap use-after-free vulnerability in DecLibRecon::createSubPicRefBufs because decompressPicture clears msubPicExtTasks without waiting for pending tasks. Attackers can supply a crafted multi-subpicture VVC bitstream to decoders using two or more thread...

CVE-2026-124308

Fraunhofer HHI VVdeC versions prior to 3.2.1 are vulnerable to a heap use-after-free vulnerability within the DecLibRecon::createSubPicRefBufs function. The root cause is that the decompressPicture function clears m_subPicExtTasks without waiting for tasks that are still pending. An attacker can ...

PT-2026-139484

Name of the Vulnerable Software and Affected Versions Fraunhofer HHI VVdeC versions prior to 3.2.1 Description A heap use-after-free issue exists in the DecLibRecon::createSubPicRefBufs function. This occurs because the decompressPicture function clears m subPicExtTasks without waiting for pendin...

CVE-2026-124308: fraunhoferhhi vvdec: Fraunhofer HHI VVdeC before 3.2.1 contains a heap use-after-free vulnerability in DecLibRecon::createSubPicRefBufs…

Fraunhofer HHI VVdeC before 3.2.1 contains a heap use-after-free vulnerability in DecLibRecon::createSubPicRefBufs because decompressPicture clears msubPicExtTasks without waiting for pending tasks. Attackers can supply a crafted multi-subpicture VVC bitstream to decoders using two or more thread...

GHSA-9RM7-3QHH-H2MC Wire: Unauthenticated decoder crash via 32-bit length integer overflow in ByteArrayProtoReader32 (incomplete fix of CVE-2026-45799)

Wire's protobuf decoders did not consistently validate attacker-controlled length-delimited sizes against the current reader bounds before computing cursor, limit, or pointer positions. In the Kotlin runtime, ProtoAdapter.decodeByteArray and ProtoAdapter.decodeByteString use the ProtoReader32 fas...

CVE-2026-54241: Heap-based Buffer Overflow

libde265 is an open source implementation of the h.265 video codec. Versions prior to 1.1.1 use signed 32-bit arithmetic to calculate the sample adaptive offset input-buffer size, allowing a crafted HEVC stream with large dimensions and 16-bit luma samples to cause an integer overflow, an...