CVE-2026-125107

The Muhammara node module, which provides c/cpp bindings for modifying PDFs with JavaScript in Node.js or Electron , is vulnerable to a NULL pointer dereference in the PDFParser::CreateFilterForStream() function (located in src/deps/PDFWriter/PDFParser.cpp). The flaw occurs when a PDF stream uses...

CVE-2026-125231

FFmpeg versions 4.4 through 9.0.2 are vulnerable to a NULL pointer dereference in libavcodec/adxdec.c. The root cause is that adx_decode_header() updates the channel layout before validating the sample rate. A crafted ADX/AAX stream containing mid-stream new-extradata side data with an invalid sa...

CVE-2026-125225

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in aacadtstoascfilter that allows attackers to crash applications via oversized ADTS AAC packets. Attackers can supply a crafted file with a packet over 256 MB, overflowing the bit count so initgetbits fails unchecked and...

CVE-2026-125225

FFmpeg versions through 9.0.2 are vulnerable to a NULL pointer dereference in the aac_adtstoasc_filter() function. An attacker can supply a crafted file containing an oversized ADTS AAC packet exceeding 256 MB. This causes a bit count overflow, leading to an unchecked failure in init_get_bits() a...

CVE-2026-125231

FFmpeg 4.4 through 9.0.2 contains a NULL pointer dereference vulnerability in libavcodec/adxdec.c because adxdecodeheader updates the channel layout before validating the sample rate. Attackers can supply a crafted ADX/AAX stream with mid-stream new-extradata side data carrying an invalid sample...

CVE-2026-125215

FFmpeg versions 7.1 through 9.0.2 are vulnerable to a NULL pointer dereference in the ff_dovi_rpu_generate() function located in libavcodec/dovi_rpuenc.c. An attacker can trigger a denial of service (DoS) by providing crafted Dolby Vision RPU metadata in streams with default or alternating omitte...

CVE-2026-125216

FFmpeg versions through 9.0.2 are vulnerable to a NULL pointer dereference in libavcodec/dpxenc.c. The flaw occurs when processing RGB48 input with unvalidated bits_per_raw_sample values. Specifically, an attacker providing a 12-bit RGB image (such as JPEG 2000 ) can trigger the encode_gbrp12() f...

CVE-2026-125215

FFmpeg 7.1 through 9.0.2 contains a NULL pointer dereference vulnerability in ffdovirpugenerate in libavcodec/dovirpuenc.c that allows attackers to crash applications via crafted Dolby Vision RPU metadata. Attackers can supply streams with default or alternating omitted DM blocks to the dovirpu...

CVE-2026-125216

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in libavcodec/dpxenc.c that allows attackers to crash the process via unvalidated bitsperrawsample for RGB48 input. Attackers can supply a 12-bit RGB image, such as JPEG 2000, that when transcoded to DPX selects encodegbrp12 a...

CVE-2026-125174

FFmpeg before 8.1.3 and 9.x before 9.0.2 contains a NULL pointer dereference vulnerability in ffhapsetchunkcount in libavcodec/hap.c, where a shadowed return variable masks reallocation failures. Attackers can supply a crafted Hap video frame with an oversized chunk count so the decoder writes...

CVE-2026-125174

FFmpeg versions before 8.1.3 and 9.x before 9.0.2 are vulnerable to a NULL pointer dereference in ff_hap_set_chunk_count() located in libavcodec/hap.c. The root cause is a shadowed return variable that masks reallocation failures. An attacker providing a crafted Hap video frame with an oversized ...

CVE-2026-125068

FFmpeg versions through 9.0.2 are vulnerable to a NULL pointer dereference in the Bink video decoder . The root cause is that the decode_frame() function in libavcodec/bink.c fails to handle errors from init_get_bits(). An attacker can exploit this by providing a crafted Bink file containing a fr...

CVE-2026-125069

FFmpeg versions through 9.0.2 are vulnerable to a NULL pointer dereference in the Motion Pixels decoder . The root cause is that the mp_decode_frame() function ignores a failure from init_get_bits(). By supplying a packet of approximately 2^28 bytes through the libavcodec API , an attacker can ov...

CVE-2026-125067

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in vbledecodeframe in libavcodec/vble.c because it ignores initgetbits failure on oversized packets. Attackers can supply a crafted AVI file with a 268435452-byte VBLE frame, causing reads from a NULL bit reader buffer that...

CVE-2026-125071

FFmpeg versions through 9.0.2 are affected by a NULL pointer dereference vulnerability in the libavcodec/jvdec.c component. An attacker can cause a denial of service (DoS) by providing an oversized JV video packet (approximately 268435460 bytes) through the libavcodec API. This oversized packet o...

CVE-2026-125067

FFmpeg versions through 9.0.2 are vulnerable to a NULL pointer dereference in the vble_decode_frame() function located in libavcodec/vble.c. The root cause is that the software ignores the failure of init_get_bits() when processing oversized packets. An attacker can provide a crafted AVI file con...

CVE-2026-125070

FFmpeg versions through 9.0.2 are vulnerable to a NULL pointer dereference in the tqi_decode_frame() function within libavcodec/eatqi.c. The vulnerability occurs because the software ignores an init_get_bits() failure following an integer overflow . An attacker can trigger this by providing a cra...

CVE-2026-125071

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in libavcodec/jvdec.c that allows attackers to crash applications by supplying oversized JV video packets. Attackers can pass a roughly 268435460-byte packet through the libavcodec API, overflowing the bit count so decodeframe...

CVE-2026-125069

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in the Motion Pixels decoder because mpdecodeframe ignores initgetbits failure. Attackers supplying a roughly 2^28-byte packet through the libavcodec API overflow the bit count, causing reads from a NULL buffer that crash the...

CVE-2026-125072

FFmpeg versions through 9.0.2 are vulnerable to a NULL pointer dereference in the mp_decode_frame() function within libavcodec/mpegaudiodec_template.c. The vulnerability occurs because the software fails to handle a init_get_bits() failure following a signed integer overflow . An attacker can exp...