CVE-2026-125244: FFmpeg before 8.1.3 and 9.x before 9.0.2 VVC Decoder Out-of-Bounds Write via sh_entry_points

Q: What must an attacker provide to trigger the flaw?

An attacker must cause the vulnerable FFmpeg VVC (H.266) decoder to process a crafted VVC bitstream. The bitstream uses SPS/PPS tile and wavefront parallel processing (WPP) layout data to create excess entry points.

Q: Which deployments are exposed?

Deployments using FFmpeg versions before 8.1.3, or 9.x versions before 9.0.2, are affected when they decode attacker-controlled VVC content. The provided data does not identify whether VVC decoding is enabled or used by default in a particular application.

Q: What is the impact if exploitation succeeds?

The excess entry points can overflow the entry_point_start_ctu buffer and corrupt decoder memory. The supplied severity vector rates confidentiality, integrity, and availability impact as high.

Published Nov 9, 2026

Updated

FFmpeg before 8.1.3 and 9.x before 9.0.2 contains an out-of-bounds write vulnerability in the VVC decoder's shentrypoints() function in libavcodec/vvc/ps.c. Attackers can supply a crafted VVC (H.266) bitstream whose SPS/PPS tile and WPP layout produces excess entry points, overflowing entrypointstartctu and corrupting decoder memory.

Affected Software

1 affected component

FFmpeg FFmpeg<8.1.3, >=9.0.0<9.0.2

Event History

Nov 9, 2026

CVE Published

via MITRE·07:11 PM

Data Sourced

via MITRE·07:11 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What must an attacker provide to trigger the flaw?

An attacker must cause the vulnerable FFmpeg VVC (H.266) decoder to process a crafted VVC bitstream. The bitstream uses SPS/PPS tile and wavefront parallel processing (WPP) layout data to create excess entry points.

Which deployments are exposed?

Deployments using FFmpeg versions before 8.1.3, or 9.x versions before 9.0.2, are affected when they decode attacker-controlled VVC content. The provided data does not identify whether VVC decoding is enabled or used by default in a particular application.

What is the impact if exploitation succeeds?

The excess entry points can overflow the entry_point_start_ctu buffer and corrupt decoder memory. The supplied severity vector rates confidentiality, integrity, and availability impact as high.

CVE-2026-125244: FFmpeg before 8.1.3 and 9.x before 9.0.2 VVC Decoder Out-of-Bounds Write via sh_entry_points

Affected Software

Event History

Frequently Asked Questions

What must an attacker provide to trigger the flaw?

Which deployments are exposed?

What is the impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

What must an attacker provide to trigger the flaw?

Which deployments are exposed?

What is the impact if exploitation succeeds?