CVE-2026-125068: FFmpeg through 9.0.2 NULL Pointer Dereference in Bink Video Decoder

Q: What must an attacker do to trigger the issue?

The attacker must provide a crafted Bink video file containing a frame of approximately 2^28 bytes. Exploitation requires the file to be processed by the vulnerable Bink decoder and user interaction is required according to the supplied CVSS vector.

Q: What is the expected security impact?

Successful exploitation crashes the affected process, resulting in denial of service. The supplied CVSS vector indicates no confidentiality or integrity impact.

Published Nov 9, 2026

Updated

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in the Bink video decoder because decodeframe() in libavcodec/bink.c ignores initgetbits() failure. Attackers can supply a crafted Bink file with a frame of about 2^28 bytes, overflowing the bit count and crashing the process for denial of service.

Affected Software

1 affected component

FFmpeg FFmpeg<=9.0.2

Event History

Nov 9, 2026

CVE Published

via MITRE·07:10 PM

Data Sourced

via MITRE·07:10 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What must an attacker do to trigger the issue?

The attacker must provide a crafted Bink video file containing a frame of approximately 2^28 bytes. Exploitation requires the file to be processed by the vulnerable Bink decoder and user interaction is required according to the supplied CVSS vector.

What is the expected security impact?

Successful exploitation crashes the affected process, resulting in denial of service. The supplied CVSS vector indicates no confidentiality or integrity impact.

CVE-2026-125068: FFmpeg through 9.0.2 NULL Pointer Dereference in Bink Video Decoder

Affected Software

Event History

Frequently Asked Questions

What must an attacker do to trigger the issue?

What is the expected security impact?

Company

Resources

Contact

Frequently Asked Questions

What must an attacker do to trigger the issue?

What is the expected security impact?