CVE-2026-125186: FFmpeg through 9.0.2 CPU Exhaustion via dts2pts Bitstream Filter

Q: Who is exposed to this issue?

Systems that process attacker-supplied H.264 packets using FFmpeg's dts2pts bitstream filter are exposed. The affected FFmpeg range is through 9.0.2.

Q: What does an attacker need to exploit it?

An attacker needs to cause the target to process a crafted H.264 packet containing many slices with alternating picture order counts through the dts2pts filter. The supplied vector indicates local access, high attack complexity, no privileges required, and user interaction required.

Q: What is the operational impact?

Processing the crafted packet can force unbounded per-slice POC tree-node allocation in h264_queue_frame(), exhausting CPU and causing denial of service. No confidentiality or integrity impact is indicated.

Published Nov 9, 2026

Updated

FFmpeg through 9.0.2 contains an uncontrolled resource consumption vulnerability in the dts2pts bitstream filter that allows attackers to exhaust CPU through unbounded per-packet POC node allocation. Attackers can supply a crafted H.264 packet with many slices of alternating picture order counts, forcing h264queueframe() to allocate tree nodes per slice and deny service.

Affected Software

1 affected component

FFmpeg FFmpeg<=9.0.2

Event History

Nov 9, 2026

CVE Published

via MITRE·07:11 PM

Data Sourced

via MITRE·07:11 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Systems that process attacker-supplied H.264 packets using FFmpeg's dts2pts bitstream filter are exposed. The affected FFmpeg range is through 9.0.2.

What does an attacker need to exploit it?

An attacker needs to cause the target to process a crafted H.264 packet containing many slices with alternating picture order counts through the dts2pts filter. The supplied vector indicates local access, high attack complexity, no privileges required, and user interaction required.

What is the operational impact?

Processing the crafted packet can force unbounded per-slice POC tree-node allocation in h264_queue_frame(), exhausting CPU and causing denial of service. No confidentiality or integrity impact is indicated.

CVE-2026-125186: FFmpeg through 9.0.2 CPU Exhaustion via dts2pts Bitstream Filter

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What is the operational impact?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What is the operational impact?