CVE-2026-125238: FFmpeg through 9.0.2 Reachable Assertion in libxevd EVC Decoder Wrapper

Q: Which applications are exposed to this denial of service?

Applications that use affected FFmpeg versions to decode attacker-controlled EVC media are exposed. The impact is an application abort when the crafted input reaches the libxevd decoder wrapper.

Q: What must an attacker provide to trigger the issue?

The attacker must cause the application to decode a crafted EVC file containing truncated or picture-less access units. The vulnerable path occurs when such an access unit produces no frame but is reported as successful.

Q: Is user interaction required?

Yes. The supplied CVSS vector includes UI:R, indicating a user must interact with the crafted media through a decoding application.

Q: How can I determine whether an application is affected?

Check whether it uses FFmpeg through 9.0.2 and invokes the EVC decoder on untrusted or externally supplied EVC files. Affected processing can abort at the assertion on frame->private_ref in libxevd_receive_frame().

Published Nov 9, 2026

Updated

FFmpeg through 9.0.2 contains a reachable assertion vulnerability in libxevdreceiveframe() in libavcodec/libxevd.c that returns success when an access unit produces no frame. Attackers can supply a crafted EVC file with truncated or picture-less access units to trigger the avassert0() on frame->privateref, aborting any decoding application.

Affected Software

1 affected component

FFmpeg FFmpeg<=9.0.2

Event History

Nov 9, 2026

CVE Published

via MITRE·07:11 PM

Data Sourced

via MITRE·07:11 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which applications are exposed to this denial of service?

Applications that use affected FFmpeg versions to decode attacker-controlled EVC media are exposed. The impact is an application abort when the crafted input reaches the libxevd decoder wrapper.

What must an attacker provide to trigger the issue?

The attacker must cause the application to decode a crafted EVC file containing truncated or picture-less access units. The vulnerable path occurs when such an access unit produces no frame but is reported as successful.

Is user interaction required?

Yes. The supplied CVSS vector includes UI:R, indicating a user must interact with the crafted media through a decoding application.

How can I determine whether an application is affected?

Check whether it uses FFmpeg through 9.0.2 and invokes the EVC decoder on untrusted or externally supplied EVC files. Affected processing can abort at the assertion on frame->private_ref in libxevd_receive_frame().

CVE-2026-125238: FFmpeg through 9.0.2 Reachable Assertion in libxevd EVC Decoder Wrapper

Affected Software

Event History

Frequently Asked Questions

Which applications are exposed to this denial of service?

What must an attacker provide to trigger the issue?

Is user interaction required?

How can I determine whether an application is affected?

Company

Resources

Contact

Frequently Asked Questions

Which applications are exposed to this denial of service?

What must an attacker provide to trigger the issue?

Is user interaction required?

How can I determine whether an application is affected?