CVE-2026-125073: FFmpeg through 9.0.2 Infinite Loop Denial of Service via IMC/IAC Decoder

Q: Who is exposed to this issue?

Systems that decode attacker-supplied IMC or IAC audio files using FFmpeg through version 9.0.2 are exposed. Exploitation requires local access and user interaction, such as causing a user or processing workflow to open the crafted audio file.

Q: What does an attacker need to trigger the denial of service?

An attacker needs to supply a crafted IMC or IAC audio file containing audio blocks that make the decoder's freebits value negative. When the file is decoded, the affected reduction loop can fail to terminate and consume 100% CPU.

Q: How can I tell whether an affected process is being exploited?

Affected decoding activity may hang while processing an IMC or IAC file, with the FFmpeg process consuming 100% CPU. The triggering condition is a negative bit budget in bit_allocation() within libavcodec/imc.c.

Published Nov 9, 2026

Updated

FFmpeg through 9.0.2 contains an infinite loop vulnerability in bitallocation() in libavcodec/imc.c that allows attackers to hang decoding by supplying audio blocks with a negative bit budget. Attackers can craft IMC or IAC audio files that drive freebits negative, causing the reduction loop to never terminate and consuming 100% CPU.

Affected Software

1 affected component

FFmpeg FFmpeg<=9.0.2

Event History

Nov 9, 2026

CVE Published

via MITRE·07:10 PM

Data Sourced

via MITRE·07:10 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Systems that decode attacker-supplied IMC or IAC audio files using FFmpeg through version 9.0.2 are exposed. Exploitation requires local access and user interaction, such as causing a user or processing workflow to open the crafted audio file.

What does an attacker need to trigger the denial of service?

An attacker needs to supply a crafted IMC or IAC audio file containing audio blocks that make the decoder's freebits value negative. When the file is decoded, the affected reduction loop can fail to terminate and consume 100% CPU.

How can I tell whether an affected process is being exploited?

Affected decoding activity may hang while processing an IMC or IAC file, with the FFmpeg process consuming 100% CPU. The triggering condition is a negative bit budget in bit_allocation() within libavcodec/imc.c.

CVE-2026-125073: FFmpeg through 9.0.2 Infinite Loop Denial of Service via IMC/IAC Decoder

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to trigger the denial of service?

How can I tell whether an affected process is being exploited?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to trigger the denial of service?

How can I tell whether an affected process is being exploited?