CVE-2026-125221: FFmpeg through 9.0.2 Uncontrolled Recursion in FLAC Parser score_header()

Q: Who is exposed to this issue?

Applications using FFmpeg through 9.0.2 that demux or parse attacker-supplied FLAC streams are exposed. The practical impact is a process crash from thread-stack exhaustion.

Q: What must an attacker do to trigger the crash?

The attacker must provide a crafted FLAC stream containing many small, valid-looking frame headers. Exploitation requires the affected application to process that input, reflected by the required user interaction in the supplied severity vector.

Q: Is confidentiality or data integrity affected?

The provided severity vector indicates no confidentiality or integrity impact. The stated impact is availability loss because parsing can exhaust the thread stack and crash the process.

Published Nov 9, 2026

Updated

FFmpeg through 9.0.2 contains an uncontrolled recursion vulnerability in scoreheader() in libavcodec/flacparser.c that allows attackers to exhaust the thread stack via crafted FLAC input. Attackers can supply a FLAC stream packed with many small valid-looking frame headers, forcing deep recursion that crashes the process during demuxing or parsing.

Affected Software

1 affected component

FFmpeg FFmpeg<=9.0.2

Event History

Nov 9, 2026

CVE Published

via MITRE·07:11 PM

Data Sourced

via MITRE·07:11 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Applications using FFmpeg through 9.0.2 that demux or parse attacker-supplied FLAC streams are exposed. The practical impact is a process crash from thread-stack exhaustion.

What must an attacker do to trigger the crash?

The attacker must provide a crafted FLAC stream containing many small, valid-looking frame headers. Exploitation requires the affected application to process that input, reflected by the required user interaction in the supplied severity vector.

Is confidentiality or data integrity affected?

The provided severity vector indicates no confidentiality or integrity impact. The stated impact is availability loss because parsing can exhaust the thread stack and crash the process.

CVE-2026-125221: FFmpeg through 9.0.2 Uncontrolled Recursion in FLAC Parser score_header()

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this issue?

What must an attacker do to trigger the crash?

Is confidentiality or data integrity affected?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What must an attacker do to trigger the crash?

Is confidentiality or data integrity affected?