CVE-2026-125065 FFmpeg through 9.0.2 NULL Pointer Dereference via TGV Decoder eatgv.c

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in tgvdecodeinter in libavcodec/eatgv.c that ignores initgetbits failure on oversized packets. Attackers can supply a crafted EA file with a kVGT frame followed by an fVGT inter frame with a 2^28-byte compressed block section,...

CVE-2026-125065 FFmpeg through 9.0.2 NULL Pointer Dereference via TGV Decoder eatgv.c

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in tgvdecodeinter in libavcodec/eatgv.c that ignores initgetbits failure on oversized packets. Attackers can supply a crafted EA file with a kVGT frame followed by an fVGT inter frame with a 2^28-byte compressed block section,...

EUVD-2026-120241

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in the Cirrus Logic AccuPak CLJR decoder in libavcodec/cljrdec.c because decodeframe ignores initgetbits failure. Attackers can supply a crafted AVI file with a 2^28-byte CLJR frame that overflows the bit count, causing reads...

CVE-2026-125066 FFmpeg through 9.0.2 NULL Pointer Dereference in CLJR Video Decoder

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in the Cirrus Logic AccuPak CLJR decoder in libavcodec/cljrdec.c because decodeframe ignores initgetbits failure. Attackers can supply a crafted AVI file with a 2^28-byte CLJR frame that overflows the bit count, causing reads...

EUVD-2026-120239

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in g726decodeframe in libavcodec/g726.c because it ignores initgetbits failure on oversized packets. Attackers can supply a crafted AVI file with a 268435392-byte G.726 audio chunk to make the decoder read from a NULL buffer,...

CVE-2026-125064 FFmpeg through 9.0.2 NULL Pointer Dereference in G.726 ADPCM Decoder

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in g726decodeframe in libavcodec/g726.c because it ignores initgetbits failure on oversized packets. Attackers can supply a crafted AVI file with a 268435392-byte G.726 audio chunk to make the decoder read from a NULL buffer,...

CVE-2026-125064

Versions of FFmpeg through 9.0.2 are vulnerable to a NULL pointer dereference in the g726_decode_frame() function located in libavcodec/g726.c. The root cause is that the decoder ignores the failure of init_get_bits() when processing oversized packets . An attacker can provide a specially crafted...

CVE-2026-125064 FFmpeg through 9.0.2 NULL Pointer Dereference in G.726 ADPCM Decoder

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in g726decodeframe in libavcodec/g726.c because it ignores initgetbits failure on oversized packets. Attackers can supply a crafted AVI file with a 268435392-byte G.726 audio chunk to make the decoder read from a NULL buffer,...

EUVD-2026-120234

The policy RPC stubs in kadmin/server/serverstubs.c in MIT Kerberos 5 aka krb5 1.5.3 and later do not reject a NULL policy name decoded by xdrnullstring, which allows remote authenticated users to cause a denial of service kadmind crash via NULL pointer dereference by sending a policy request wit...

CVE-2026-112318 Krb5: mit krb5 kadmind authenticated dos exploiting dereference of null policy name pointers

The policy RPC stubs in kadmin/server/serverstubs.c in MIT Kerberos 5 aka krb5 1.5.3 and later do not reject a NULL policy name decoded by xdrnullstring, which allows remote authenticated users to cause a denial of service kadmind crash via NULL pointer dereference by sending a policy request wit...

CVE-2026-112318

MIT Kerberos 5 (krb5) versions 1.5.3 and later are vulnerable to a denial of service (DoS) due to a flaw in the policy RPC stubs located in kadmin/server/server_stubs.c. The software fails to reject a NULL policy name decoded by xdr_nullstring(), which can lead to a kadmind crash via a NULL point...

CVE-2026-112318

The policy RPC stubs in kadmin/server/serverstubs.c in MIT Kerberos 5 aka krb5 1.5.3 and later do not reject a NULL policy name decoded by xdrnullstring, which allows remote authenticated users to cause a denial of service kadmind crash via NULL pointer dereference by sending a policy request wit...

CVE-2026-112318

The policy RPC stubs in kadmin/server/serverstubs.c in MIT Kerberos 5 aka krb5 1.5.3 and later do not reject a NULL policy name decoded by xdrnullstring, which allows remote authenticated users to cause a denial of service kadmind crash via NULL pointer dereference by sending a policy request wit...

PT-2026-141002

FFmpeg before 8.1.3 and 9.x before 9.0.2 contains a NULL pointer dereference vulnerability in ff hap set chunk count in libavcodec/hap.c, where a shadowed return variable masks reallocation failures. Attackers can supply a crafted Hap video frame with an oversized chunk count so the decoder write...

PT-2026-141053

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in aac adtstoasc filter that allows attackers to crash applications via oversized ADTS AAC packets. Attackers can supply a crafted file with a packet over 256 MB, overflowing the bit count so init get bits fails unchecked and...

PT-2026-140979

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in tgv decode inter in libavcodec/eatgv.c that ignores init get bits failure on oversized packets. Attackers can supply a crafted EA file with a kVGT frame followed by an fVGT inter frame with a 2^28-byte compressed block...

PT-2026-140978

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in g726 decode frame in libavcodec/g726.c because it ignores init get bits failure on oversized packets. Attackers can supply a crafted AVI file with a 268435392-byte G.726 audio chunk to make the decoder read from a NULL...

CVE-2026-125064: FFmpeg: FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in g726_decode_frame() in libavcodec/g726.c…

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in g726decodeframe in libavcodec/g726.c because it ignores initgetbits failure on oversized packets. Attackers can supply a crafted AVI file with a 268435392-byte G.726 audio chunk to make the decoder read from a NULL buffer,...

CVE-2026-125067: FFmpeg: FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in vble_decode_frame() in libavcodec/vble.c…

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in vbledecodeframe in libavcodec/vble.c because it ignores initgetbits failure on oversized packets. Attackers can supply a crafted AVI file with a 268435452-byte VBLE frame, causing reads from a NULL bit reader buffer that...

CVE-2026-125215: FFmpeg: FFmpeg 7.1 through 9.0.2 contains a NULL pointer dereference vulnerability in ff_dovi_rpu_generate() in…

FFmpeg 7.1 through 9.0.2 contains a NULL pointer dereference vulnerability in ffdovirpugenerate in libavcodec/dovirpuenc.c that allows attackers to crash applications via crafted Dolby Vision RPU metadata. Attackers can supply streams with default or alternating omitted DM blocks to the dovirpu...