CVE-2026-125072: FFmpeg through 9.0.2 NULL Pointer Dereference in MPEG Audio Decoder

Q: What conditions are required to trigger the crash?

An attacker must be able to supply an oversized packet to the mp3adu decoder through the libavcodec API. Exploitation also requires user interaction and is rated local with high attack complexity.

Q: What is the expected impact?

The issue can cause the affected process to crash through reads via a NULL buffer. The provided severity vector indicates no confidentiality or integrity impact, with availability impact only.

Q: Which component should be reviewed for exposure?

Review applications that use FFmpeg's libavcodec API and invoke the mp3adu decoder on packet data that may be attacker-controlled. The vulnerable code path is mp_decode_frame() in libavcodec/mpegaudiodec_template.c.

Published Nov 9, 2026

Updated

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in mpdecodeframe() in libavcodec/mpegaudiodectemplate.c because initgetbits() failure is ignored after a signed integer overflow. Attackers can pass an oversized packet to the mp3adu decoder through the libavcodec API, causing reads through a NULL buffer that crash the process.

Affected Software

1 affected component

FFmpeg FFmpeg<=9.0.2

Event History

Nov 9, 2026

CVE Published

via MITRE·07:10 PM

Data Sourced

via MITRE·07:10 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:16 PM

DescriptionSeverityWeakness

Event

via NVD·07:16 PM

Frequently Asked Questions

What conditions are required to trigger the crash?

An attacker must be able to supply an oversized packet to the mp3adu decoder through the libavcodec API. Exploitation also requires user interaction and is rated local with high attack complexity.

What is the expected impact?

The issue can cause the affected process to crash through reads via a NULL buffer. The provided severity vector indicates no confidentiality or integrity impact, with availability impact only.

Which component should be reviewed for exposure?

Review applications that use FFmpeg's libavcodec API and invoke the mp3adu decoder on packet data that may be attacker-controlled. The vulnerable code path is mp_decode_frame() in libavcodec/mpegaudiodec_template.c.

CVE-2026-125072: FFmpeg through 9.0.2 NULL Pointer Dereference in MPEG Audio Decoder

Affected Software

Event History

Frequently Asked Questions

What conditions are required to trigger the crash?

What is the expected impact?

Which component should be reviewed for exposure?

Company

Resources

Contact

Frequently Asked Questions

What conditions are required to trigger the crash?

What is the expected impact?

Which component should be reviewed for exposure?