CVE-2026-125189: FFmpeg 8.1 through 9.0.2 Denial of Service via lcevc_metadata Bitstream Filter

Q: What conditions are required to trigger the denial of service?

An attacker must cause FFmpeg to process a crafted LCEVC access unit containing two IDR or non-IDR NAL units through the lcevc_metadata bitstream filter. The malformed input triggers an av_assert0 failure in ff_cbs_lcevc_list_add(), aborting the application.

Q: What is the practical impact on an affected application?

The vulnerable condition causes the application to abort, resulting in denial of service. The supplied information does not indicate confidentiality or integrity impact.

Q: Are installations that do not use the lcevc_metadata bitstream filter affected?

The described vulnerable code is in the lcevc_metadata bitstream filter, and exploitation requires processing crafted LCEVC access units through that filter. The provided information does not establish impact for applications that do not invoke it.

Published Nov 9, 2026

Updated

FFmpeg 8.1 through 9.0.2 contains a denial of service vulnerability in the lcevcmetadata bitstream filter caused by a process block position mismatch in lcevcmetadatahandlevui(). Attackers can supply crafted LCEVC access units with two IDR or non-IDR NAL units to trigger an avassert0 failure in ffcbslcevclistadd(), aborting the application.

Affected Software

1 affected component

FFmpeg FFmpeg>=8.1<=9.0.2

Event History

Nov 9, 2026

CVE Published

via MITRE·07:11 PM

Data Sourced

via MITRE·07:11 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What conditions are required to trigger the denial of service?

An attacker must cause FFmpeg to process a crafted LCEVC access unit containing two IDR or non-IDR NAL units through the lcevc_metadata bitstream filter. The malformed input triggers an av_assert0 failure in ff_cbs_lcevc_list_add(), aborting the application.

What is the practical impact on an affected application?

The vulnerable condition causes the application to abort, resulting in denial of service. The supplied information does not indicate confidentiality or integrity impact.

Are installations that do not use the lcevc_metadata bitstream filter affected?

The described vulnerable code is in the lcevc_metadata bitstream filter, and exploitation requires processing crafted LCEVC access units through that filter. The provided information does not establish impact for applications that do not invoke it.

CVE-2026-125189: FFmpeg 8.1 through 9.0.2 Denial of Service via lcevc_metadata Bitstream Filter

Affected Software

Event History

Frequently Asked Questions

What conditions are required to trigger the denial of service?

What is the practical impact on an affected application?

Are installations that do not use the lcevc_metadata bitstream filter affected?

Company

Resources

Contact

Frequently Asked Questions

What conditions are required to trigger the denial of service?

What is the practical impact on an affected application?

Are installations that do not use the lcevc_metadata bitstream filter affected?