CVE-2026-125066: FFmpeg through 9.0.2 NULL Pointer Dereference in CLJR Video Decoder

Q: What must an attacker provide to trigger the crash?

An attacker must cause FFmpeg to decode a crafted AVI file containing a 2^28-byte CLJR frame. The oversized frame overflows the bit count, after which the decoder can read through a NULL buffer and crash the process.

Q: Is user interaction required?

Yes. The vector specifies user interaction, so a user or workflow must open or otherwise process the crafted AVI file with an affected FFmpeg instance.

Q: What is the practical impact?

The reported impact is denial of service: the affected decoding process can crash. The provided data does not indicate confidentiality or integrity impact.

Q: Which deployments are exposed?

Deployments that decode AVI content using FFmpeg's Cirrus Logic AccuPak (CLJR) decoder are exposed. The provided information identifies FFmpeg through 9.0.2, but does not provide configuration-specific exposure details.

Published Nov 9, 2026

Updated

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in the Cirrus Logic AccuPak (CLJR) decoder in libavcodec/cljrdec.c because decodeframe() ignores initgetbits() failure. Attackers can supply a crafted AVI file with a 2^28-byte CLJR frame that overflows the bit count, causing reads from a NULL buffer and crashing the process.

Affected Software

1 affected component

FFmpeg FFmpeg<=9.0.2

Event History

Nov 9, 2026

CVE Published

via MITRE·07:10 PM

Data Sourced

via MITRE·07:10 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:16 PM

DescriptionSeverityWeakness

Event

via NVD·07:16 PM

Frequently Asked Questions

What must an attacker provide to trigger the crash?

An attacker must cause FFmpeg to decode a crafted AVI file containing a 2^28-byte CLJR frame. The oversized frame overflows the bit count, after which the decoder can read through a NULL buffer and crash the process.

Is user interaction required?

Yes. The vector specifies user interaction, so a user or workflow must open or otherwise process the crafted AVI file with an affected FFmpeg instance.

What is the practical impact?

The reported impact is denial of service: the affected decoding process can crash. The provided data does not indicate confidentiality or integrity impact.

Which deployments are exposed?

Deployments that decode AVI content using FFmpeg's Cirrus Logic AccuPak (CLJR) decoder are exposed. The provided information identifies FFmpeg through 9.0.2, but does not provide configuration-specific exposure details.

CVE-2026-125066: FFmpeg through 9.0.2 NULL Pointer Dereference in CLJR Video Decoder

Affected Software

Event History

Frequently Asked Questions

What must an attacker provide to trigger the crash?

Is user interaction required?

What is the practical impact?

Which deployments are exposed?

Company

Resources

Contact

Frequently Asked Questions

What must an attacker provide to trigger the crash?

Is user interaction required?

What is the practical impact?

Which deployments are exposed?