CVE-2026-125220: FFmpeg through 9.0.2 Mimic Decoder Deadlock via Frame Threading Failure

Q: What conditions are required to trigger the deadlock?

An attacker must cause FFmpeg to decode a crafted file containing an oversized Mimic intra frame followed by inter frames. The affected decoding must use frame threading; the crafted input also requires user interaction under the supplied vector.

Q: What is the operational impact of successful exploitation?

The decoder can hang indefinitely, causing a denial of service. The provided impact vector indicates availability impact only, with no stated confidentiality or integrity impact.

Q: Which deployments should prioritize remediation?

Prioritize systems that decode untrusted or externally supplied media files and have frame-threaded decoding enabled. The issue is described as affecting FFmpeg through version 9.0.2.

Published Nov 9, 2026

Updated

FFmpeg through 9.0.2 contains a deadlock vulnerability in mimicdecodeframe() in libavcodec/mimic.c that fails to report frame progress when initgetbits8() fails. Attackers can supply a crafted file with an oversized Mimic intra frame followed by inter frames to hang frame-threaded decoding indefinitely.

Affected Software

1 affected component

FFmpeg FFmpeg<=9.0.2

Event History

Nov 9, 2026

CVE Published

via MITRE·07:11 PM

Data Sourced

via MITRE·07:11 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What conditions are required to trigger the deadlock?

An attacker must cause FFmpeg to decode a crafted file containing an oversized Mimic intra frame followed by inter frames. The affected decoding must use frame threading; the crafted input also requires user interaction under the supplied vector.

What is the operational impact of successful exploitation?

The decoder can hang indefinitely, causing a denial of service. The provided impact vector indicates availability impact only, with no stated confidentiality or integrity impact.

Which deployments should prioritize remediation?

Prioritize systems that decode untrusted or externally supplied media files and have frame-threaded decoding enabled. The issue is described as affecting FFmpeg through version 9.0.2.

CVE-2026-125220: FFmpeg through 9.0.2 Mimic Decoder Deadlock via Frame Threading Failure

Affected Software

Event History

Frequently Asked Questions

What conditions are required to trigger the deadlock?

What is the operational impact of successful exploitation?

Which deployments should prioritize remediation?

Company

Resources

Contact

Frequently Asked Questions

What conditions are required to trigger the deadlock?

What is the operational impact of successful exploitation?

Which deployments should prioritize remediation?