CVE-2026-125172: FFmpeg through 9.0.2 Out-of-Bounds Read via libxevd EVC NAL Length
FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in libxevdreceiveframe() in libavcodec/libxevd.c that fails to validate NAL unit length prefixes against remaining packet data. Attackers can supply crafted EVC media with oversized 4-byte NAL length prefixes, causing libxevd to read past the packet buffer, crashing the application or exposing adjacent heap memory.
Affected Software
Event History
Frequently Asked Questions
What must an attacker provide to trigger this issue?
An attacker must cause FFmpeg to process crafted EVC media containing an oversized 4-byte NAL unit length prefix. Exploitation requires local attack vector conditions and user interaction, according to the supplied severity vector.
What is the practical impact of successful exploitation?
The out-of-bounds read can crash the application, causing denial of service. It may also expose adjacent heap memory, resulting in limited confidentiality impact.
Which deployments should be prioritized for review?
Prioritize applications that use FFmpeg to decode EVC media, particularly where users can open or import media from untrusted sources. The affected code is in libxevd_receive_frame() in libavcodec/libxevd.c.
How can I tell whether my code path is affected?
Review whether your FFmpeg integration processes EVC streams through libxevd. The vulnerable condition involves NAL length prefixes that are not validated against the remaining packet data.