CVE-2026-125067: FFmpeg through 9.0.2 VBLE Decoder NULL Pointer Dereference via vble_decode_frame()

Q: Which deployments are exposed?

Deployments using FFmpeg through 9.0.2 to decode AVI files with VBLE frames are exposed. The impact is process availability: decoding a crafted frame can crash the process.

Q: What must an attacker do to trigger the crash?

The attacker must provide a crafted AVI file containing a 268435452-byte VBLE frame and have it processed by the vulnerable decoder. The supplied vector indicates user interaction is required, such as opening or otherwise processing the file.

Q: How can I determine whether my environment is affected?

Check whether the FFmpeg version is 9.0.2 or earlier and whether the application decodes AVI content using the VBLE decoder. A crash while processing an AVI file with an oversized VBLE frame is consistent with this issue.

Published Nov 9, 2026

Updated

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in vbledecodeframe() in libavcodec/vble.c because it ignores initgetbits() failure on oversized packets. Attackers can supply a crafted AVI file with a 268435452-byte VBLE frame, causing reads from a NULL bit reader buffer that crash the process.

Affected Software

1 affected component

FFmpeg FFmpeg<=9.0.2

Event History

Nov 9, 2026

CVE Published

via MITRE·07:10 PM

Data Sourced

via MITRE·07:10 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed?

Deployments using FFmpeg through 9.0.2 to decode AVI files with VBLE frames are exposed. The impact is process availability: decoding a crafted frame can crash the process.

What must an attacker do to trigger the crash?

The attacker must provide a crafted AVI file containing a 268435452-byte VBLE frame and have it processed by the vulnerable decoder. The supplied vector indicates user interaction is required, such as opening or otherwise processing the file.

How can I determine whether my environment is affected?

Check whether the FFmpeg version is 9.0.2 or earlier and whether the application decodes AVI content using the VBLE decoder. A crash while processing an AVI file with an oversized VBLE frame is consistent with this issue.

CVE-2026-125067: FFmpeg through 9.0.2 VBLE Decoder NULL Pointer Dereference via vble_decode_frame()

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed?

What must an attacker do to trigger the crash?

How can I determine whether my environment is affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What must an attacker do to trigger the crash?

How can I determine whether my environment is affected?