CVE-2026-125225: FFmpeg through 9.0.2 NULL Pointer Dereference via aac_adtstoasc Bitstream Filter

Q: Which processing paths are affected?

The issue is triggered when the aac_adtstoasc bitstream filter processes ADTS AAC during remuxing to MP4, Matroska, FLV, or LATM.

Q: What must an attacker provide to trigger the crash?

An attacker needs to supply a crafted ADTS AAC file containing a packet larger than 256 MB. The oversized packet causes a bit-count overflow, after which an unchecked initialization failure can lead to a NULL-pointer crash.

Q: What is the expected impact of successful exploitation?

Successful exploitation crashes the application processing the crafted media. The provided CVSS vector indicates local attack access, no required privileges, and required user interaction; it does not indicate confidentiality or integrity impact.

Q: How can I determine whether an application is exposed?

Applications using FFmpeg through 9.0.2 may be exposed if they remux attacker-controlled or otherwise untrusted ADTS AAC input into MP4, Matroska, FLV, or LATM using the affected bitstream filter.

Published Nov 9, 2026

Updated

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in aacadtstoascfilter() that allows attackers to crash applications via oversized ADTS AAC packets. Attackers can supply a crafted file with a packet over 256 MB, overflowing the bit count so initgetbits() fails unchecked and getbits() crashes during MP4, Matroska, FLV or LATM remuxing.

Affected Software

1 affected component

FFmpeg FFmpeg<=9.0.2

Event History

Nov 9, 2026

CVE Published

via MITRE·07:11 PM

Data Sourced

via MITRE·07:11 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which processing paths are affected?

The issue is triggered when the aac_adtstoasc bitstream filter processes ADTS AAC during remuxing to MP4, Matroska, FLV, or LATM.

What must an attacker provide to trigger the crash?

An attacker needs to supply a crafted ADTS AAC file containing a packet larger than 256 MB. The oversized packet causes a bit-count overflow, after which an unchecked initialization failure can lead to a NULL-pointer crash.

What is the expected impact of successful exploitation?

Successful exploitation crashes the application processing the crafted media. The provided CVSS vector indicates local attack access, no required privileges, and required user interaction; it does not indicate confidentiality or integrity impact.

How can I determine whether an application is exposed?

Applications using FFmpeg through 9.0.2 may be exposed if they remux attacker-controlled or otherwise untrusted ADTS AAC input into MP4, Matroska, FLV, or LATM using the affected bitstream filter.

CVE-2026-125225: FFmpeg through 9.0.2 NULL Pointer Dereference via aac_adtstoasc Bitstream Filter

Affected Software

Event History

Frequently Asked Questions

Which processing paths are affected?

What must an attacker provide to trigger the crash?

What is the expected impact of successful exploitation?

How can I determine whether an application is exposed?

Company

Resources

Contact

Frequently Asked Questions

Which processing paths are affected?

What must an attacker provide to trigger the crash?

What is the expected impact of successful exploitation?

How can I determine whether an application is exposed?