CVE-2026-128239 GPAC through 26.07.0 NULL Pointer Dereference via MPEG-4 Form Handlers

GPAC through 26.07.0 contains a NULL pointer dereference vulnerability in the MPEG-4 Form spatial-constraint handlers in src/compositor/mpeg4form.c that lets attackers crash the process via unchecked group lookups. Attackers can supply a crafted XMT scene whose Form constraints reference a...

SUSE CVE-2026-125103

FFmpeg through 9.0.2 contains an information disclosure vulnerability in ffmlzdecompression in libavcodec/mlz.c, which accepts string codes beyond the dictionary's next free code. Attackers can supply a crafted MPEG-4 ALS file with malformed initial or out-of-range codes to copy uninitialized hea...

UBUNTU-CVE-2026-125232

FFmpeg through 9.0.2 contains a division by zero vulnerability in estimatemotionb in libavcodec/motionest.c, caused by frame timestamp distances truncated to 16 bits. Attackers can supply input with timestamp gaps that are multiples of 65536, crashing MPEG-4 Part 2 or MPEG-1/2 B-frame encoding wi...

UBUNTU-CVE-2026-125103

FFmpeg through 9.0.2 contains an information disclosure vulnerability in ffmlzdecompression in libavcodec/mlz.c, which accepts string codes beyond the dictionary's next free code. Attackers can supply a crafted MPEG-4 ALS file with malformed initial or out-of-range codes to copy uninitialized hea...

CVE-2026-125232

FFmpeg through 9.0.2 contains a division by zero vulnerability in estimatemotionb in libavcodec/motionest.c, caused by frame timestamp distances truncated to 16 bits. Attackers can supply input with timestamp gaps that are multiples of 65536, crashing MPEG-4 Part 2 or MPEG-1/2 B-frame encoding wi...

CVE-2026-125103

FFmpeg through 9.0.2 contains an information disclosure vulnerability in ffmlzdecompression in libavcodec/mlz.c, which accepts string codes beyond the dictionary's next free code. Attackers can supply a crafted MPEG-4 ALS file with malformed initial or out-of-range codes to copy uninitialized hea...

CVE-2026-125232

FFmpeg versions through 9.0.2 are vulnerable to a division by zero vulnerability within the estimate_motion_b() function in libavcodec/motion_est.c. The root cause is that frame timestamp distances are truncated to 16 bits; specifically, an attacker can provide input with timestamp gaps that are ...

EUVD-2026-120182

FFmpeg through 9.0.2 contains a division by zero vulnerability in estimatemotionb in libavcodec/motionest.c, caused by frame timestamp distances truncated to 16 bits. Attackers can supply input with timestamp gaps that are multiples of 65536, crashing MPEG-4 Part 2 or MPEG-1/2 B-frame encoding wi...

CVE-2026-125232 FFmpeg through 9.0.2 Division by Zero in B-frame Motion Estimation

FFmpeg through 9.0.2 contains a division by zero vulnerability in estimatemotionb in libavcodec/motionest.c, caused by frame timestamp distances truncated to 16 bits. Attackers can supply input with timestamp gaps that are multiples of 65536, crashing MPEG-4 Part 2 or MPEG-1/2 B-frame encoding wi...

EUVD-2026-120257

FFmpeg through 9.0.2 contains an information disclosure vulnerability in ffmlzdecompression in libavcodec/mlz.c, which accepts string codes beyond the dictionary's next free code. Attackers can supply a crafted MPEG-4 ALS file with malformed initial or out-of-range codes to copy uninitialized hea...

CVE-2026-125103

FFmpeg versions through 9.0.2 are vulnerable to an information disclosure vulnerability within the ff_mlz_decompression() function in libavcodec/mlz.c. The root cause is the acceptance of string codes that exceed the dictionary's next free code. An attacker can provide a crafted MPEG-4 ALS file c...

PT-2026-140996

FFmpeg through 9.0.2 contains an information disclosure vulnerability in ff mlz decompression in libavcodec/mlz.c, which accepts string codes beyond the dictionary's next free code. Attackers can supply a crafted MPEG-4 ALS file with malformed initial or out-of-range codes to copy uninitialized...

PT-2026-141060

FFmpeg through 9.0.2 contains a division by zero vulnerability in estimate motion b in libavcodec/motion est.c, caused by frame timestamp distances truncated to 16 bits. Attackers can supply input with timestamp gaps that are multiples of 65536, crashing MPEG-4 Part 2 or MPEG-1/2 B-frame encoding...

CVE-2026-125103: FFmpeg: FFmpeg through 9.0.2 contains an information disclosure vulnerability in ff_mlz_decompression() in libavcodec/mlz.c,…

FFmpeg through 9.0.2 contains an information disclosure vulnerability in ffmlzdecompression in libavcodec/mlz.c, which accepts string codes beyond the dictionary's next free code. Attackers can supply a crafted MPEG-4 ALS file with malformed initial or out-of-range codes to copy uninitialized hea...

CVE-2026-125232: FFmpeg: FFmpeg through 9.0.2 contains a division by zero vulnerability in estimate_motion_b() in libavcodec/motion_est.c,…

FFmpeg through 9.0.2 contains a division by zero vulnerability in estimatemotionb in libavcodec/motionest.c, caused by frame timestamp distances truncated to 16 bits. Attackers can supply input with timestamp gaps that are multiples of 65536, crashing MPEG-4 Part 2 or MPEG-1/2 B-frame encoding wi...

CVE-2025-60479

A NULL pointer dereference in the StatSFVec2f function /scenemanager/scenestats.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service DoS via supplying a crafted MPEG-4 file...

Linux Distros Unpatched Vulnerability : CVE-2025-60479

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A NULL pointer dereference in the StatSFVec2f function /scenemanager/scenestats.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Servic...

CVE-2025-60479

A NULL pointer dereference in the StatSFVec2f function /scenemanager/scenestats.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service DoS via supplying a crafted MPEG-4 file...

PT-2026-120605

A NULL pointer dereference in the StatSFVec2f function /scene manager/scene stats.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service DoS via supplying a crafted MPEG-4 file...

CVE-2025-60479

The GPAC Project/MP4Box software, specifically versions prior to 2.5 , is vulnerable to a NULL pointer dereference within the StatSFVec2f function located in /scene_manager/scene_stats.c. This flaw allows an attacker to trigger a Denial of Service (DoS) condition by providing a crafted MPEG-4 fil...