CVE-2026-125068

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in the Bink video decoder because decodeframe in libavcodec/bink.c ignores initgetbits failure. Attackers can supply a crafted Bink file with a frame of about 2^28 bytes, overflowing the bit count and crashing the process for...

CVE-2026-125072

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in mpdecodeframe in libavcodec/mpegaudiodectemplate.c because initgetbits failure is ignored after a signed integer overflow. Attackers can pass an oversized packet to the mp3adu decoder through the libavcodec API, causing rea...

CVE-2026-125070

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in tqidecodeframe in libavcodec/eatqi.c, which ignores initgetbits failure after an integer overflow. Attackers can supply a crafted EA file with a pIQT chunk carrying a 2^28-byte payload to crash the process, causing denial o...

CVE-2026-125065

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in tgvdecodeinter in libavcodec/eatgv.c that ignores initgetbits failure on oversized packets. Attackers can supply a crafted EA file with a kVGT frame followed by an fVGT inter frame with a 2^28-byte compressed block section,...

CVE-2026-125066

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in the Cirrus Logic AccuPak CLJR decoder in libavcodec/cljrdec.c because decodeframe ignores initgetbits failure. Attackers can supply a crafted AVI file with a 2^28-byte CLJR frame that overflows the bit count, causing reads...

CVE-2026-125064

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in g726decodeframe in libavcodec/g726.c because it ignores initgetbits failure on oversized packets. Attackers can supply a crafted AVI file with a 268435392-byte G.726 audio chunk to make the decoder read from a NULL buffer,...

CVE-2026-112318

The policy RPC stubs in kadmin/server/serverstubs.c in MIT Kerberos 5 aka krb5 1.5.3 and later do not reject a NULL policy name decoded by xdrnullstring, which allows remote authenticated users to cause a denial of service kadmind crash via NULL pointer dereference by sending a policy request wit...

ALPINE-CVE-2026-112318

The policy RPC stubs in kadmin/server/serverstubs.c in MIT Kerberos 5 aka krb5 1.5.3 and later do not reject a NULL policy name decoded by xdrnullstring, which allows remote authenticated users to cause a denial of service kadmind crash via NULL pointer dereference by sending a policy request wit...

CVE-2026-125231

Versions FFmpeg 4.4 through 9.0.2 are vulnerable to a NULL pointer dereference in libavcodec/adxdec.c. The root cause is that adx_decode_header() updates the channel layout before validating the sample rate. An attacker can provide a crafted ADX/AAX stream containing mid-stream new-extradata side...

CVE-2026-125231 FFmpeg 4.4 through 9.0.2 NULL Pointer Dereference via adx_decode_header()

FFmpeg 4.4 through 9.0.2 contains a NULL pointer dereference vulnerability in libavcodec/adxdec.c because adxdecodeheader updates the channel layout before validating the sample rate. Attackers can supply a crafted ADX/AAX stream with mid-stream new-extradata side data carrying an invalid sample...

EUVD-2026-120181

FFmpeg 4.4 through 9.0.2 contains a NULL pointer dereference vulnerability in libavcodec/adxdec.c because adxdecodeheader updates the channel layout before validating the sample rate. Attackers can supply a crafted ADX/AAX stream with mid-stream new-extradata side data carrying an invalid sample...

CVE-2026-125231 FFmpeg 4.4 through 9.0.2 NULL Pointer Dereference via adx_decode_header()

FFmpeg 4.4 through 9.0.2 contains a NULL pointer dereference vulnerability in libavcodec/adxdec.c because adxdecodeheader updates the channel layout before validating the sample rate. Attackers can supply a crafted ADX/AAX stream with mid-stream new-extradata side data carrying an invalid sample...

CVE-2026-125225 FFmpeg through 9.0.2 NULL Pointer Dereference via aac_adtstoasc Bitstream Filter

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in aacadtstoascfilter that allows attackers to crash applications via oversized ADTS AAC packets. Attackers can supply a crafted file with a packet over 256 MB, overflowing the bit count so initgetbits fails unchecked and...

EUVD-2026-120175

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in aacadtstoascfilter that allows attackers to crash applications via oversized ADTS AAC packets. Attackers can supply a crafted file with a packet over 256 MB, overflowing the bit count so initgetbits fails unchecked and...

CVE-2026-125225 FFmpeg through 9.0.2 NULL Pointer Dereference via aac_adtstoasc Bitstream Filter

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in aacadtstoascfilter that allows attackers to crash applications via oversized ADTS AAC packets. Attackers can supply a crafted file with a packet over 256 MB, overflowing the bit count so initgetbits fails unchecked and...

CVE-2026-125225

FFmpeg versions through 9.0.2 are susceptible to a NULL pointer dereference vulnerability within the aac_adtstoasc_filter() function. An attacker can crash applications by providing a crafted file containing an oversized ADTS AAC packet exceeding 256 MB. This causes an overflow in the bit count, ...

EUVD-2026-120305

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in libavcodec/dpxenc.c that allows attackers to crash the process via unvalidated bitsperrawsample for RGB48 input. Attackers can supply a 12-bit RGB image, such as JPEG 2000, that when transcoded to DPX selects encodegbrp12 a...

CVE-2026-125216

FFmpeg versions through 9.0.2 are vulnerable to a NULL pointer dereference in libavcodec/dpxenc.c. The issue occurs when processing RGB48 input with unvalidated bits_per_raw_sample. Specifically, providing a 12-bit RGB image (such as JPEG 2000) during transcoding to DPX triggers the encode_gbrp12...

CVE-2026-125216 FFmpeg through 9.0.2 DPX Encoder NULL Pointer Dereference via encode_gbrp12()

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in libavcodec/dpxenc.c that allows attackers to crash the process via unvalidated bitsperrawsample for RGB48 input. Attackers can supply a 12-bit RGB image, such as JPEG 2000, that when transcoded to DPX selects encodegbrp12 a...

CVE-2026-125215

FFmpeg versions 7.1 through 9.0.2 are affected by a NULL pointer dereference vulnerability in the ff_dovi_rpu_generate() function located in libavcodec/dovi_rpuenc.c. An attacker can trigger a denial of service by providing crafted Dolby Vision RPU metadata , specifically by supplying streams wit...