CVE-2026-125065: FFmpeg through 9.0.2 NULL Pointer Dereference via TGV Decoder eatgv.c

Q: What must an attacker provide to trigger the crash?

The attacker must supply a crafted EA file containing a kVGT frame followed by an fVGT inter frame whose compressed block section is 2^28 bytes. Processing that file can cause the affected FFmpeg process to crash.

Q: What is the practical impact of successful exploitation?

Successful exploitation causes a denial of service by crashing the process. The provided information does not indicate confidentiality or integrity impact.

Q: Which deployments are most exposed?

Deployments that process attacker-controlled or otherwise untrusted EA media files are exposed to this denial-of-service condition. Exploitation requires local attack vector access and user interaction, according to the supplied severity vector.

Q: How can I determine whether a build is affected?

The issue is reported in FFmpeg through version 9.0.2 and affects tgv_decode_inter() in libavcodec/eatgv.c. Review the source or applied fixes for commit 9691e4fde64e14de73c298562c4e475f9412b5ad.

Published Nov 9, 2026

Updated

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in tgvdecodeinter() in libavcodec/eatgv.c that ignores initgetbits() failure on oversized packets. Attackers can supply a crafted EA file with a kVGT frame followed by an fVGT inter frame with a 2^28-byte compressed block section, crashing the process for denial of service.

Affected Software

1 affected component

FFmpeg FFmpeg<=9.0.2

Event History

Nov 9, 2026

CVE Published

via MITRE·07:10 PM

Data Sourced

via MITRE·07:10 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What must an attacker provide to trigger the crash?

The attacker must supply a crafted EA file containing a kVGT frame followed by an fVGT inter frame whose compressed block section is 2^28 bytes. Processing that file can cause the affected FFmpeg process to crash.

What is the practical impact of successful exploitation?

Successful exploitation causes a denial of service by crashing the process. The provided information does not indicate confidentiality or integrity impact.

Which deployments are most exposed?

Deployments that process attacker-controlled or otherwise untrusted EA media files are exposed to this denial-of-service condition. Exploitation requires local attack vector access and user interaction, according to the supplied severity vector.

How can I determine whether a build is affected?

The issue is reported in FFmpeg through version 9.0.2 and affects tgv_decode_inter() in libavcodec/eatgv.c. Review the source or applied fixes for commit 9691e4fde64e14de73c298562c4e475f9412b5ad.

CVE-2026-125065: FFmpeg through 9.0.2 NULL Pointer Dereference via TGV Decoder eatgv.c

Affected Software

Event History

Frequently Asked Questions

What must an attacker provide to trigger the crash?

What is the practical impact of successful exploitation?

Which deployments are most exposed?

How can I determine whether a build is affected?

Company

Resources

Contact

Frequently Asked Questions

What must an attacker provide to trigger the crash?

What is the practical impact of successful exploitation?

Which deployments are most exposed?

How can I determine whether a build is affected?