CVE-2026-125254: FFmpeg through 9.0.2 Division by Zero via VVC ff_vvc_slice_rpl()
Published Nov 9, 2026
·Updated
FFmpeg through 9.0.2 contains a division by zero vulnerability in the VVC decoder because ffvvcslicerpl() fails to validate numrefidxactive against built reference list entries. Attackers can supply a crafted VVC bitstream whose excess reference indices yield a zero POC difference in ffvvcmvscale(), crashing the decoding process.
Affected Software
1 affected component
FFmpeg FFmpeg<=9.0.2
Event History
Nov 9, 2026
CVE Published
via MITRE·07:11 PM
Data Sourced
via MITRE·07:11 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·08:18 PM
DescriptionSeverityWeakness