CVE-2026-125254

FFmpeg through 9.0.2 contains a division by zero vulnerability in the VVC decoder because ffvvcslicerpl fails to validate numrefidxactive against built reference list entries. Attackers can supply a crafted VVC bitstream whose excess reference indices yield a zero POC difference in ffvvcmvscale,...

EUVD-2026-120204

FFmpeg through 9.0.2 contains a division by zero vulnerability in the VVC decoder because ffvvcslicerpl fails to validate numrefidxactive against built reference list entries. Attackers can supply a crafted VVC bitstream whose excess reference indices yield a zero POC difference in ffvvcmvscale,...

CVE-2026-125254

The FFmpeg software (versions through 9.0.2 ) is susceptible to a division by zero vulnerability within the VVC decoder . The root cause is that the ff_vvc_slice_rpl() function fails to validate num_ref_idx_active against the built reference list entries. An attacker can trigger this by providing...