CVE-2026-125174: FFmpeg before 8.1.3 and 9.x before 9.0.2 NULL Pointer Dereference via ff_hap_set_chunk_count()

Q: Who is exposed to this issue?

Applications using affected FFmpeg versions that decode Hap video frames are exposed. Exploitation requires the application to process an attacker-supplied crafted Hap frame.

Q: What does an attacker need to do to trigger the crash?

The attacker must provide a Hap video frame with an oversized chunk count. This can cause a reallocation failure to be masked, followed by a write through a NULL chunk table.

Q: What is the impact of successful exploitation?

Successful exploitation crashes the decoding application, resulting in a denial of service. The provided severity vector indicates no confidentiality or integrity impact.

Q: Which versions should be updated?

Update FFmpeg 8.x to 8.1.3 or later, and FFmpeg 9.x to 9.0.2 or later. Versions before 8.1.3 and 9.x before 9.0.2 are identified as affected.

Published Nov 9, 2026

Updated

FFmpeg before 8.1.3 and 9.x before 9.0.2 contains a NULL pointer dereference vulnerability in ffhapsetchunkcount() in libavcodec/hap.c, where a shadowed return variable masks reallocation failures. Attackers can supply a crafted Hap video frame with an oversized chunk count so the decoder writes through a NULL chunk table, crashing the application.

Affected Software

1 affected component

FFmpeg FFmpeg<8.1.3, >=9.0.0<9.0.2

Event History

Nov 9, 2026

CVE Published

via MITRE·07:11 PM

Data Sourced

via MITRE·07:11 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Applications using affected FFmpeg versions that decode Hap video frames are exposed. Exploitation requires the application to process an attacker-supplied crafted Hap frame.

What does an attacker need to do to trigger the crash?

The attacker must provide a Hap video frame with an oversized chunk count. This can cause a reallocation failure to be masked, followed by a write through a NULL chunk table.

What is the impact of successful exploitation?

Successful exploitation crashes the decoding application, resulting in a denial of service. The provided severity vector indicates no confidentiality or integrity impact.

Which versions should be updated?

Update FFmpeg 8.x to 8.1.3 or later, and FFmpeg 9.x to 9.0.2 or later. Versions before 8.1.3 and 9.x before 9.0.2 are identified as affected.

CVE-2026-125174: FFmpeg before 8.1.3 and 9.x before 9.0.2 NULL Pointer Dereference via ff_hap_set_chunk_count()

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to do to trigger the crash?

What is the impact of successful exploitation?

Which versions should be updated?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to do to trigger the crash?

What is the impact of successful exploitation?

Which versions should be updated?