CVE-2026-125215: FFmpeg 7.1 through 9.0.2 NULL Pointer Dereference via ff_dovi_rpu_generate()

Q: Which deployments are exposed to this issue?

Applications using FFmpeg versions 7.1 through 9.0.2 are exposed when they process attacker-supplied Dolby Vision RPU metadata through the dovi_rpu bitstream filter with compression enabled.

Q: What must an attacker provide to trigger the crash?

The attacker needs to supply a crafted stream containing Dolby Vision RPU metadata with default or alternating omitted DM blocks. Exploitation requires local access, high attack complexity, and user interaction according to the provided vector.

Q: What is the expected impact of successful exploitation?

Successful exploitation causes a NULL pointer dereference in ff_dovi_rpu_generate(), crashing the affected application. The reported impact is denial of service, with no confidentiality or integrity impact indicated.

Published Nov 9, 2026

Updated

FFmpeg 7.1 through 9.0.2 contains a NULL pointer dereference vulnerability in ffdovirpugenerate() in libavcodec/dovirpuenc.c that allows attackers to crash applications via crafted Dolby Vision RPU metadata. Attackers can supply streams with default or alternating omitted DM blocks to the dovirpu bitstream filter with compression enabled, causing denial of service.

Affected Software

1 affected component

FFmpeg FFmpeg>=7.1<=9.0.2

Event History

Nov 9, 2026

CVE Published

via MITRE·07:11 PM

Data Sourced

via MITRE·07:11 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Applications using FFmpeg versions 7.1 through 9.0.2 are exposed when they process attacker-supplied Dolby Vision RPU metadata through the dovi_rpu bitstream filter with compression enabled.

What must an attacker provide to trigger the crash?

The attacker needs to supply a crafted stream containing Dolby Vision RPU metadata with default or alternating omitted DM blocks. Exploitation requires local access, high attack complexity, and user interaction according to the provided vector.

What is the expected impact of successful exploitation?

Successful exploitation causes a NULL pointer dereference in ff_dovi_rpu_generate(), crashing the affected application. The reported impact is denial of service, with no confidentiality or integrity impact indicated.

CVE-2026-125215: FFmpeg 7.1 through 9.0.2 NULL Pointer Dereference via ff_dovi_rpu_generate()

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What must an attacker provide to trigger the crash?

What is the expected impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What must an attacker provide to trigger the crash?

What is the expected impact of successful exploitation?