UBUNTU-CVE-2026-125069: Null Pointer Dereference
FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in the Motion Pixels decoder because mpdecodeframe() ignores initgetbits() failure. Attackers supplying a roughly 2^28-byte packet through the libavcodec API overflow the bit count, causing reads from a NULL buffer that crash the process.
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Applications on Ubuntu that use FFmpeg's libavcodec API and decode attacker-supplied Motion Pixels packets are exposed. The impact described is a process crash, affecting availability rather than confidentiality or integrity.
What does an attacker need to trigger the crash?
An attacker must be able to supply a specially sized Motion Pixels packet to the application's libavcodec decoding path. The packet is roughly 2^28 bytes, and exploitation also requires user interaction according to the provided vector.
How can I determine whether an application may be affected?
Check whether it uses FFmpeg through version 9.0.2 and invokes the Motion Pixels decoder through libavcodec. Affected crash attempts involve unusually large, roughly 2^28-byte packets that cause the decoder to read from a NULL buffer.