CVE-2026-125216: FFmpeg through 9.0.2 DPX Encoder NULL Pointer Dereference via encode_gbrp12()

Q: What input and processing path are required to trigger the crash?

An attacker must cause FFmpeg to transcode a 12-bit RGB image, such as JPEG 2000, to DPX. This selects encode_gbrp12(), where an unvalidated bits_per_raw_sample value can lead to NULL plane-pointer dereferences.

Q: What is the practical impact of successful exploitation?

Successful exploitation crashes the FFmpeg process, resulting in denial of service. The provided data does not indicate confidentiality or integrity impact.

Q: Are only remotely supplied files affected?

The attack vector is local and requires user interaction. Exposure exists where a user or workflow processes attacker-supplied 12-bit RGB content through FFmpeg's DPX transcoding path.

Published Nov 9, 2026

Updated

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in libavcodec/dpxenc.c that allows attackers to crash the process via unvalidated bitsperrawsample for RGB48 input. Attackers can supply a 12-bit RGB image, such as JPEG 2000, that when transcoded to DPX selects encodegbrp12() and dereferences NULL plane pointers, causing denial of service.

Affected Software

1 affected component

FFmpeg FFmpeg<=9.0.2

Event History

Nov 9, 2026

CVE Published

via MITRE·07:11 PM

Data Sourced

via MITRE·07:11 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What input and processing path are required to trigger the crash?

An attacker must cause FFmpeg to transcode a 12-bit RGB image, such as JPEG 2000, to DPX. This selects encode_gbrp12(), where an unvalidated bits_per_raw_sample value can lead to NULL plane-pointer dereferences.

What is the practical impact of successful exploitation?

Successful exploitation crashes the FFmpeg process, resulting in denial of service. The provided data does not indicate confidentiality or integrity impact.

Are only remotely supplied files affected?

The attack vector is local and requires user interaction. Exposure exists where a user or workflow processes attacker-supplied 12-bit RGB content through FFmpeg's DPX transcoding path.

CVE-2026-125216: FFmpeg through 9.0.2 DPX Encoder NULL Pointer Dereference via encode_gbrp12()

Affected Software

Event History

Frequently Asked Questions

What input and processing path are required to trigger the crash?

What is the practical impact of successful exploitation?

Are only remotely supplied files affected?

Company

Resources

Contact

Frequently Asked Questions

What input and processing path are required to trigger the crash?

What is the practical impact of successful exploitation?

Are only remotely supplied files affected?