CVE-2026-125064: FFmpeg through 9.0.2 NULL Pointer Dereference in G.726 ADPCM Decoder

Q: What must an attacker provide to trigger the crash?

The attacker must supply a crafted AVI file containing a 268435392-byte G.726 audio chunk. Exploitation requires a user or process to decode that file with an affected FFmpeg installation.

Q: What is the practical impact of successful exploitation?

The crafted packet causes the G.726 decoder to read from a NULL buffer, crashing the FFmpeg process. The provided data describes an availability impact and does not indicate confidentiality or integrity impact.

Q: Which deployments are exposed?

Deployments that use FFmpeg through 9.0.2 to process untrusted AVI files with G.726 audio are exposed. The issue is in the G.726 decoder path, so installations that do not decode such content are not described as reachable by the provided data.

Published Nov 9, 2026

Updated

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in g726decodeframe() in libavcodec/g726.c because it ignores initgetbits() failure on oversized packets. Attackers can supply a crafted AVI file with a 268435392-byte G.726 audio chunk to make the decoder read from a NULL buffer, crashing the process.

Affected Software

1 affected component

FFmpeg FFmpeg<=9.0.2

Event History

Nov 9, 2026

CVE Published

via MITRE·07:10 PM

Data Sourced

via MITRE·07:10 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What must an attacker provide to trigger the crash?

The attacker must supply a crafted AVI file containing a 268435392-byte G.726 audio chunk. Exploitation requires a user or process to decode that file with an affected FFmpeg installation.

What is the practical impact of successful exploitation?

The crafted packet causes the G.726 decoder to read from a NULL buffer, crashing the FFmpeg process. The provided data describes an availability impact and does not indicate confidentiality or integrity impact.

Which deployments are exposed?

Deployments that use FFmpeg through 9.0.2 to process untrusted AVI files with G.726 audio are exposed. The issue is in the G.726 decoder path, so installations that do not decode such content are not described as reachable by the provided data.

CVE-2026-125064: FFmpeg through 9.0.2 NULL Pointer Dereference in G.726 ADPCM Decoder

Affected Software

Event History

Frequently Asked Questions

What must an attacker provide to trigger the crash?

What is the practical impact of successful exploitation?

Which deployments are exposed?

Company

Resources

Contact

Frequently Asked Questions

What must an attacker provide to trigger the crash?

What is the practical impact of successful exploitation?

Which deployments are exposed?