CVE-2026-125071: FFmpeg through 9.0.2 NULL Pointer Dereference in JV Video Decoder

Q: Does exploitation require attacker privileges or user interaction?

The CVSS vector indicates no attacker privileges are required, but user interaction is required. The attacker must be able to cause an application to pass a crafted JV video packet to the libavcodec API.

Q: What packet characteristics trigger the crash?

The issue is triggered by an oversized JV video packet of roughly 268,435,460 bytes. The packet size overflows the bit count, causing decode_frame() to read from a NULL buffer.

Q: What is the resulting impact?

Successful exploitation crashes the affected application, resulting in denial of service. The provided data indicates no confidentiality or integrity impact.

Published Nov 9, 2026

Updated

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in libavcodec/jvdec.c that allows attackers to crash applications by supplying oversized JV video packets. Attackers can pass a roughly 268435460-byte packet through the libavcodec API, overflowing the bit count so decodeframe() reads from a NULL buffer and causes denial of service.

Affected Software

1 affected component

FFmpeg FFmpeg<=9.0.2

Event History

Nov 9, 2026

CVE Published

via MITRE·07:10 PM

Data Sourced

via MITRE·07:10 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Does exploitation require attacker privileges or user interaction?

The CVSS vector indicates no attacker privileges are required, but user interaction is required. The attacker must be able to cause an application to pass a crafted JV video packet to the libavcodec API.

What packet characteristics trigger the crash?

The issue is triggered by an oversized JV video packet of roughly 268,435,460 bytes. The packet size overflows the bit count, causing decode_frame() to read from a NULL buffer.

What is the resulting impact?

Successful exploitation crashes the affected application, resulting in denial of service. The provided data indicates no confidentiality or integrity impact.

CVE-2026-125071: FFmpeg through 9.0.2 NULL Pointer Dereference in JV Video Decoder

Affected Software

Event History

Frequently Asked Questions

Does exploitation require attacker privileges or user interaction?

What packet characteristics trigger the crash?

What is the resulting impact?

Company

Resources

Contact

Frequently Asked Questions

Does exploitation require attacker privileges or user interaction?

What packet characteristics trigger the crash?

What is the resulting impact?