CVE-2026-125258: FFmpeg through 9.0.2 Division by Zero via dovi_configure_ext() in dovi_rpuenc.c

Q: Which processing paths are exposed to the crash?

The affected code can be reached through the dovi_rpu bitstream filter and through the libx265, libaom, or libsvtav1 encoders when handling HEVC or AV1 input.

Q: What must an attacker provide to trigger the issue?

An attacker must supply crafted HEVC or AV1 input whose frame rate has a nonzero numerator and a zero denominator. Triggering also requires the vulnerable processing path to use dovi_configure_ext().

Q: What is the practical impact of successful exploitation?

Successful exploitation causes a division by zero that crashes the affected process, resulting in denial of service. The provided data does not indicate confidentiality or integrity impact.

Q: How can I determine whether a workflow may be affected?

Review whether the workflow processes attacker-controlled HEVC or AV1 input using the dovi_rpu bitstream filter or the libx265, libaom, or libsvtav1 encoders. Inputs with a zero frame-rate denominator and nonzero numerator are the relevant trigger condition.

Published Nov 9, 2026

Updated

FFmpeg through 9.0.2 contains a division by zero vulnerability in doviconfigureext() in libavcodec/dovirpuenc.c that allows attackers to crash the process via an unvalidated frame rate denominator. Attackers can supply a crafted HEVC or AV1 input with a nonzero frame rate numerator and zero denominator to the dovirpu bitstream filter or libx265, libaom, or libsvtav1 encoders, causing denial of service.

Affected Software

1 affected component

FFmpeg FFmpeg<=9.0.2

Event History

Nov 9, 2026

CVE Published

via MITRE·07:12 PM

Data Sourced

via MITRE·07:12 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which processing paths are exposed to the crash?

The affected code can be reached through the dovi_rpu bitstream filter and through the libx265, libaom, or libsvtav1 encoders when handling HEVC or AV1 input.

What must an attacker provide to trigger the issue?

An attacker must supply crafted HEVC or AV1 input whose frame rate has a nonzero numerator and a zero denominator. Triggering also requires the vulnerable processing path to use dovi_configure_ext().

What is the practical impact of successful exploitation?

Successful exploitation causes a division by zero that crashes the affected process, resulting in denial of service. The provided data does not indicate confidentiality or integrity impact.

How can I determine whether a workflow may be affected?

Review whether the workflow processes attacker-controlled HEVC or AV1 input using the dovi_rpu bitstream filter or the libx265, libaom, or libsvtav1 encoders. Inputs with a zero frame-rate denominator and nonzero numerator are the relevant trigger condition.

CVE-2026-125258: FFmpeg through 9.0.2 Division by Zero via dovi_configure_ext() in dovi_rpuenc.c

Affected Software

Event History

Frequently Asked Questions

Which processing paths are exposed to the crash?

What must an attacker provide to trigger the issue?

What is the practical impact of successful exploitation?

How can I determine whether a workflow may be affected?

Company

Resources

Contact

Frequently Asked Questions

Which processing paths are exposed to the crash?

What must an attacker provide to trigger the issue?

What is the practical impact of successful exploitation?

How can I determine whether a workflow may be affected?