UBUNTU-CVE-2026-125067: Null Pointer Dereference
FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in vbledecodeframe() in libavcodec/vble.c because it ignores initgetbits() failure on oversized packets. Attackers can supply a crafted AVI file with a 268435452-byte VBLE frame, causing reads from a NULL bit reader buffer that crash the process.
Affected Software
Event History
Frequently Asked Questions
What must an attacker provide to trigger the crash?
An attacker must supply a crafted AVI file containing a 268435452-byte VBLE frame. Exploitation requires a local attack vector and user interaction, such as having a user or local workflow process the malicious file.
What is the practical impact of successful exploitation?
The crafted frame causes FFmpeg to read through a NULL bit-reader buffer and crash the affected process. The provided impact data indicates an availability impact only; it does not indicate confidentiality or integrity impact.
How can I determine whether my environment may be affected?
Check whether Ubuntu systems use FFmpeg to process AVI files with VBLE-encoded frames. The issue is described as affecting FFmpeg through version 9.0.2; compare the installed package version and any Ubuntu security update status against that information.