CVE-2026-125246: FFmpeg through 9.0.2 Assertion Failure DoS via cbs_jpeg_assemble_fragment

Q: Which deployments are exposed to this denial of service?

Deployments using FFmpeg through 9.0.2 are affected when they process attacker-supplied JPEG or MJPEG streams with CBS-based bitstream filters. The failure occurs during processing of a crafted scan header.

Q: What does an attacker need to do to trigger the issue?

An attacker must provide a crafted JPEG or MJPEG stream containing 0xff in the JPEG scan header and induce the target to process it through a CBS-based bitstream filter. The supplied vector indicates local attack access and user interaction are required.

Q: What is the practical impact of successful exploitation?

Processing the crafted stream can trigger an av_assert0 abort in cbs_jpeg_assemble_fragment(), causing a denial of service. The provided information indicates no confidentiality or integrity impact.

Q: How can I determine whether an instance may be affected?

Check whether the installed FFmpeg version is 9.0.2 or earlier and whether the workflow processes untrusted JPEG or MJPEG input through CBS-based bitstream filters. Systems that do not use those filters are not described as triggering this assertion failure.

Published Nov 9, 2026

Updated

FFmpeg through 9.0.2 contains a denial of service vulnerability in cbsjpegassemblefragment() that miscounts 0xff stuffing bytes in JPEG scan headers. Attackers can supply a crafted JPEG/MJPEG stream with 0xff in the scan header, triggering an avassert0 abort when CBS-based bitstream filters process it.

Affected Software

1 affected component

FFmpeg FFmpeg<=9.0.2

Event History

Nov 9, 2026

CVE Published

via MITRE·07:11 PM

Data Sourced

via MITRE·07:11 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this denial of service?

Deployments using FFmpeg through 9.0.2 are affected when they process attacker-supplied JPEG or MJPEG streams with CBS-based bitstream filters. The failure occurs during processing of a crafted scan header.

What does an attacker need to do to trigger the issue?

An attacker must provide a crafted JPEG or MJPEG stream containing 0xff in the JPEG scan header and induce the target to process it through a CBS-based bitstream filter. The supplied vector indicates local attack access and user interaction are required.

What is the practical impact of successful exploitation?

Processing the crafted stream can trigger an av_assert0 abort in cbs_jpeg_assemble_fragment(), causing a denial of service. The provided information indicates no confidentiality or integrity impact.

How can I determine whether an instance may be affected?

Check whether the installed FFmpeg version is 9.0.2 or earlier and whether the workflow processes untrusted JPEG or MJPEG input through CBS-based bitstream filters. Systems that do not use those filters are not described as triggering this assertion failure.

CVE-2026-125246: FFmpeg through 9.0.2 Assertion Failure DoS via cbs_jpeg_assemble_fragment

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed to this denial of service?

What does an attacker need to do to trigger the issue?

What is the practical impact of successful exploitation?

How can I determine whether an instance may be affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this denial of service?

What does an attacker need to do to trigger the issue?

What is the practical impact of successful exploitation?

How can I determine whether an instance may be affected?