CVE-2026-125187: FFmpeg through 9.0.2 TTA Encoder Reachable Assertion via tta_encode_frame()

Q: Which deployments are exposed to this issue?

Applications using FFmpeg through 9.0.2 to transcode audio into the TTA format are exposed. The impact is an application abort, so services that process attacker-supplied audio into TTA are the most relevant cases.

Q: What does an attacker need to trigger the failure?

An attacker needs to provide audio input with sample values and a length that produce a small, poorly compressible final TTA frame. No privileges are required, but user interaction is required according to the supplied severity vector.

Q: What is the practical impact of successful exploitation?

The assertion in flush_put_bits() aborts the transcoding application. The provided data indicates availability impact only, with no confidentiality or integrity impact.

Published Nov 9, 2026

Updated

FFmpeg through 9.0.2 contains a reachable assertion vulnerability in the TTA encoder's ttaencodeframe() in libavcodec/ttaenc.c, which never reserves output packet space for the 4-byte CRC. Attackers can supply audio whose sample values and length produce a small, poorly compressible final frame, triggering the avassert0() in flushputbits() and aborting applications transcoding to TTA.

Affected Software

1 affected component

FFmpeg FFmpeg<=9.0.2

Event History

Nov 9, 2026

CVE Published

via MITRE·07:11 PM

Data Sourced

via MITRE·07:11 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Applications using FFmpeg through 9.0.2 to transcode audio into the TTA format are exposed. The impact is an application abort, so services that process attacker-supplied audio into TTA are the most relevant cases.

What does an attacker need to trigger the failure?

An attacker needs to provide audio input with sample values and a length that produce a small, poorly compressible final TTA frame. No privileges are required, but user interaction is required according to the supplied severity vector.

What is the practical impact of successful exploitation?

The assertion in flush_put_bits() aborts the transcoding application. The provided data indicates availability impact only, with no confidentiality or integrity impact.

CVE-2026-125187: FFmpeg through 9.0.2 TTA Encoder Reachable Assertion via tta_encode_frame()

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to trigger the failure?

What is the practical impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to trigger the failure?

What is the practical impact of successful exploitation?