CVE-2026-125264: FFmpeg through 9.0.2 CPU Exhaustion via JPEG XL Parser TOC Count
FFmpeg through 9.0.2 contains an uncontrolled resource consumption vulnerability in parseframeheader() in libavcodec/jpegxlparser.c that fails to validate TOC entry counts against remaining input. Attackers can supply a crafted JPEG XL frame header with a permuted TOC and huge toccount, making the parser loop excessively and exhaust CPU.
Affected Software
Event History
Frequently Asked Questions
What conditions are required to trigger the CPU exhaustion?
An attacker must cause FFmpeg to parse a crafted JPEG XL frame header containing a permuted TOC and an excessively large TOC entry count. The issue is triggered during parsing in parse_frame_header().
Is user interaction required for exploitation?
Yes. The supplied CVSS vector includes UI:R, indicating that user interaction is required. The vector also indicates local attack vector access and no privileges required.
What is the impact of successful exploitation?
The parser can loop excessively and consume CPU resources, resulting in a denial-of-service condition. The supplied vector indicates availability impact only, with no confidentiality or integrity impact.
Which FFmpeg versions are affected?
The provided information states that FFmpeg through version 9.0.2 is affected. No fixed release version is specified in the data.