CVE-2026-125070: FFmpeg through 9.0.2 NULL Pointer Dereference in EA TQI Decoder

Q: What must an attacker provide to trigger the crash?

An attacker must supply a crafted EA file containing a pIQT chunk with a 2^28-byte payload. Processing that file through the affected EA TQI decoder can cause the FFmpeg process to crash.

Q: What is the practical impact of successful exploitation?

The described impact is denial of service: the vulnerable process crashes because of a NULL pointer dereference. No confidentiality or integrity impact is stated.

Q: Which deployments are most exposed?

Deployments that decode attacker-controlled or otherwise untrusted EA files are exposed to this attack path. The attack vector is local and requires user interaction, so an affected file must be opened or otherwise submitted for processing.

Q: What can be done if updating FFmpeg is not immediately possible?

Avoid processing untrusted EA files, particularly files that may contain oversized pIQT chunks. Restricting who can supply media files to the affected decoding workflow reduces exposure.

Published Nov 9, 2026

Updated

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in tqidecodeframe() in libavcodec/eatqi.c, which ignores initgetbits() failure after an integer overflow. Attackers can supply a crafted EA file with a pIQT chunk carrying a 2^28-byte payload to crash the process, causing denial of service.

Affected Software

1 affected component

FFmpeg FFmpeg<=9.0.2

Event History

Nov 9, 2026

CVE Published

via MITRE·07:10 PM

Data Sourced

via MITRE·07:10 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What must an attacker provide to trigger the crash?

An attacker must supply a crafted EA file containing a pIQT chunk with a 2^28-byte payload. Processing that file through the affected EA TQI decoder can cause the FFmpeg process to crash.

What is the practical impact of successful exploitation?

The described impact is denial of service: the vulnerable process crashes because of a NULL pointer dereference. No confidentiality or integrity impact is stated.

Which deployments are most exposed?

Deployments that decode attacker-controlled or otherwise untrusted EA files are exposed to this attack path. The attack vector is local and requires user interaction, so an affected file must be opened or otherwise submitted for processing.

What can be done if updating FFmpeg is not immediately possible?

Avoid processing untrusted EA files, particularly files that may contain oversized pIQT chunks. Restricting who can supply media files to the affected decoding workflow reduces exposure.

CVE-2026-125070: FFmpeg through 9.0.2 NULL Pointer Dereference in EA TQI Decoder

Affected Software

Event History

Frequently Asked Questions

What must an attacker provide to trigger the crash?

What is the practical impact of successful exploitation?

Which deployments are most exposed?

What can be done if updating FFmpeg is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

What must an attacker provide to trigger the crash?

What is the practical impact of successful exploitation?

Which deployments are most exposed?

What can be done if updating FFmpeg is not immediately possible?