CVE-2026-125069: FFmpeg through 9.0.2 NULL Pointer Dereference via Motion Pixels Decoder

Q: What must an attacker provide to trigger the crash?

The attacker must cause the application to pass a roughly 2^28-byte Motion Pixels packet to FFmpeg through the libavcodec API. Exploitation also requires user interaction and has high attack complexity according to the supplied vector.

Q: What is the expected impact of successful exploitation?

Successful exploitation causes reads through a NULL buffer and crashes the affected process. The supplied severity vector indicates availability impact only, with no confidentiality or integrity impact.

Q: Are applications using FFmpeg exposed by default?

Exposure depends on whether the application decodes Motion Pixels content through the libavcodec API and can be made to process an attacker-supplied packet of the required size. The provided information does not establish that every FFmpeg deployment is affected in its default configuration.

Published Nov 9, 2026

Updated

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in the Motion Pixels decoder because mpdecodeframe() ignores initgetbits() failure. Attackers supplying a roughly 2^28-byte packet through the libavcodec API overflow the bit count, causing reads from a NULL buffer that crash the process.

Affected Software

1 affected component

FFmpeg FFmpeg<=9.0.2

Event History

Nov 9, 2026

CVE Published

via MITRE·07:10 PM

Data Sourced

via MITRE·07:10 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What must an attacker provide to trigger the crash?

The attacker must cause the application to pass a roughly 2^28-byte Motion Pixels packet to FFmpeg through the libavcodec API. Exploitation also requires user interaction and has high attack complexity according to the supplied vector.

What is the expected impact of successful exploitation?

Successful exploitation causes reads through a NULL buffer and crashes the affected process. The supplied severity vector indicates availability impact only, with no confidentiality or integrity impact.

Are applications using FFmpeg exposed by default?

Exposure depends on whether the application decodes Motion Pixels content through the libavcodec API and can be made to process an attacker-supplied packet of the required size. The provided information does not establish that every FFmpeg deployment is affected in its default configuration.

CVE-2026-125069: FFmpeg through 9.0.2 NULL Pointer Dereference via Motion Pixels Decoder

Affected Software

Event History

Frequently Asked Questions

What must an attacker provide to trigger the crash?

What is the expected impact of successful exploitation?

Are applications using FFmpeg exposed by default?

Company

Resources

Contact

Frequently Asked Questions

What must an attacker provide to trigger the crash?

What is the expected impact of successful exploitation?

Are applications using FFmpeg exposed by default?