CVE-2026-125232: FFmpeg through 9.0.2 Division by Zero in B-frame Motion Estimation

Q: What conditions are required to trigger the crash?

An attacker must be able to supply input used for MPEG-4 Part 2 or MPEG-1/2 B-frame encoding. The input must contain frame timestamp gaps that are multiples of 65,536, which cause a truncated timestamp distance to become zero and trigger SIGFPE.

Q: What is the practical impact?

Successful exploitation crashes the affected encoding process with SIGFPE, causing a denial of service. The provided severity vector indicates local attack vector, no required privileges, and user interaction.

Q: Which deployments are most exposed?

Deployments that encode untrusted or attacker-controlled media into MPEG-4 Part 2 or MPEG-1/2 with B-frames are exposed. The issue is in FFmpeg through version 9.0.2; the provided information does not identify configuration-level mitigations or workarounds.

Published Nov 9, 2026

Updated

FFmpeg through 9.0.2 contains a division by zero vulnerability in estimatemotionb() in libavcodec/motionest.c, caused by frame timestamp distances truncated to 16 bits. Attackers can supply input with timestamp gaps that are multiples of 65536, crashing MPEG-4 Part 2 or MPEG-1/2 B-frame encoding with SIGFPE.

Affected Software

1 affected component

FFmpeg FFmpeg<=9.0.2

Event History

Nov 9, 2026

CVE Published

via MITRE·07:11 PM

Data Sourced

via MITRE·07:11 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What conditions are required to trigger the crash?

An attacker must be able to supply input used for MPEG-4 Part 2 or MPEG-1/2 B-frame encoding. The input must contain frame timestamp gaps that are multiples of 65,536, which cause a truncated timestamp distance to become zero and trigger SIGFPE.

What is the practical impact?

Successful exploitation crashes the affected encoding process with SIGFPE, causing a denial of service. The provided severity vector indicates local attack vector, no required privileges, and user interaction.

Which deployments are most exposed?

Deployments that encode untrusted or attacker-controlled media into MPEG-4 Part 2 or MPEG-1/2 with B-frames are exposed. The issue is in FFmpeg through version 9.0.2; the provided information does not identify configuration-level mitigations or workarounds.

CVE-2026-125232: FFmpeg through 9.0.2 Division by Zero in B-frame Motion Estimation

Affected Software

Event History

Frequently Asked Questions

What conditions are required to trigger the crash?

What is the practical impact?

Which deployments are most exposed?

Company

Resources

Contact

Frequently Asked Questions

What conditions are required to trigger the crash?

What is the practical impact?

Which deployments are most exposed?