CVE-2026-125072

FFmpeg versions through 9.0.2 are vulnerable to a NULL pointer dereference within the mp_decode_frame() function in libavcodec/mpegaudiodec_template.c. The root cause is that the init_get_bits() failure is ignored following a signed integer overflow . An attacker can exploit this by providing an ...

EUVD-2026-120245

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in tqidecodeframe in libavcodec/eatqi.c, which ignores initgetbits failure after an integer overflow. Attackers can supply a crafted EA file with a pIQT chunk carrying a 2^28-byte payload to crash the process, causing denial o...

CVE-2026-125070

Versions of FFmpeg through 9.0.2 are vulnerable to a NULL pointer dereference in the tqi_decode_frame() function located in libavcodec/eatqi.c. The root cause is an integer overflow that leads to the code ignoring a failure in init_get_bits(). An attacker can exploit this by providing a crafted E...

CVE-2026-125070 FFmpeg through 9.0.2 NULL Pointer Dereference in EA TQI Decoder

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in tqidecodeframe in libavcodec/eatqi.c, which ignores initgetbits failure after an integer overflow. Attackers can supply a crafted EA file with a pIQT chunk carrying a 2^28-byte payload to crash the process, causing denial o...

EUVD-2026-120243

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in the Bink video decoder because decodeframe in libavcodec/bink.c ignores initgetbits failure. Attackers can supply a crafted Bink file with a frame of about 2^28 bytes, overflowing the bit count and crashing the process for...

CVE-2026-125069 FFmpeg through 9.0.2 NULL Pointer Dereference via Motion Pixels Decoder

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in the Motion Pixels decoder because mpdecodeframe ignores initgetbits failure. Attackers supplying a roughly 2^28-byte packet through the libavcodec API overflow the bit count, causing reads from a NULL buffer that crash the...

CVE-2026-125069

Versions of FFmpeg through 9.0.2 are vulnerable to a NULL pointer dereference within the Motion Pixels decoder . The root cause is that the mp_decode_frame() function fails to properly handle errors from init_get_bits(). An attacker can exploit this by providing a packet of approximately 2^28 byt...

CVE-2026-125068

Versions of FFmpeg through 9.0.2 are affected by a NULL pointer dereference vulnerability within the Bink video decoder . The issue occurs because the decode_frame() function in libavcodec/bink.c fails to handle errors returned by init_get_bits(). An attacker can exploit this by providing a craft...

EUVD-2026-120244

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in the Motion Pixels decoder because mpdecodeframe ignores initgetbits failure. Attackers supplying a roughly 2^28-byte packet through the libavcodec API overflow the bit count, causing reads from a NULL buffer that crash the...

CVE-2026-125068 FFmpeg through 9.0.2 NULL Pointer Dereference in Bink Video Decoder

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in the Bink video decoder because decodeframe in libavcodec/bink.c ignores initgetbits failure. Attackers can supply a crafted Bink file with a frame of about 2^28 bytes, overflowing the bit count and crashing the process for...

CVE-2026-125067 FFmpeg through 9.0.2 VBLE Decoder NULL Pointer Dereference via vble_decode_frame()

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in vbledecodeframe in libavcodec/vble.c because it ignores initgetbits failure on oversized packets. Attackers can supply a crafted AVI file with a 268435452-byte VBLE frame, causing reads from a NULL bit reader buffer that...

CVE-2026-125067

FFmpeg versions through 9.0.2 are vulnerable to a NULL pointer dereference in the vble_decode_frame() function located in libavcodec/vble.c. The flaw occurs because the software ignores the failure of init_get_bits() when processing oversized packets . An attacker can exploit this by providing a ...

EUVD-2026-120242

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in vbledecodeframe in libavcodec/vble.c because it ignores initgetbits failure on oversized packets. Attackers can supply a crafted AVI file with a 268435452-byte VBLE frame, causing reads from a NULL bit reader buffer that...

EUVD-2026-120240

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in tgvdecodeinter in libavcodec/eatgv.c that ignores initgetbits failure on oversized packets. Attackers can supply a crafted EA file with a kVGT frame followed by an fVGT inter frame with a 2^28-byte compressed block section,...

CVE-2026-125066 FFmpeg through 9.0.2 NULL Pointer Dereference in CLJR Video Decoder

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in the Cirrus Logic AccuPak CLJR decoder in libavcodec/cljrdec.c because decodeframe ignores initgetbits failure. Attackers can supply a crafted AVI file with a 2^28-byte CLJR frame that overflows the bit count, causing reads...

CVE-2026-125065 FFmpeg through 9.0.2 NULL Pointer Dereference via TGV Decoder eatgv.c

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in tgvdecodeinter in libavcodec/eatgv.c that ignores initgetbits failure on oversized packets. Attackers can supply a crafted EA file with a kVGT frame followed by an fVGT inter frame with a 2^28-byte compressed block section,...

CVE-2026-125065

Versions of FFmpeg through 9.0.2 are vulnerable to a NULL pointer dereference in the tgv_decode_inter() function located in libavcodec/eatgv.c. The flaw exists because the software ignores init_get_bits() failures when processing oversized packets. An attacker can trigger a denial of service (DoS...

CVE-2026-125066

FFmpeg versions through 9.0.2 are vulnerable to a NULL pointer dereference in the Cirrus Logic AccuPak (CLJR) decoder located in libavcodec/cljrdec.c. The root cause is that the decode_frame() function ignores the failure of init_get_bits(). An attacker can trigger this by providing a crafted AVI...

EUVD-2026-120241

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in the Cirrus Logic AccuPak CLJR decoder in libavcodec/cljrdec.c because decodeframe ignores initgetbits failure. Attackers can supply a crafted AVI file with a 2^28-byte CLJR frame that overflows the bit count, causing reads...

EUVD-2026-120239

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in g726decodeframe in libavcodec/g726.c because it ignores initgetbits failure on oversized packets. Attackers can supply a crafted AVI file with a 268435392-byte G.726 audio chunk to make the decoder read from a NULL buffer,...