UBUNTU-CVE-2026-125064: Null Pointer Dereference
FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in g726decodeframe() in libavcodec/g726.c because it ignores initgetbits() failure on oversized packets. Attackers can supply a crafted AVI file with a 268435392-byte G.726 audio chunk to make the decoder read from a NULL buffer, crashing the process.
Affected Software
Event History
Frequently Asked Questions
What conditions are required to trigger the crash?
An attacker must provide a crafted AVI file containing a 268435392-byte G.726 audio chunk and cause a vulnerable FFmpeg decoder to process it. The issue is triggered when g726_decode_frame() handles the oversized packet and reads from a NULL buffer.
What is the practical impact of successful exploitation?
Successful exploitation crashes the decoding process, causing a denial of service. The provided data does not indicate confidentiality or integrity impact.
Which FFmpeg releases are affected?
FFmpeg through version 9.0.2 is reported as affected. The provided data does not identify an Ubuntu-fixed package version.