UBUNTU-CVE-2026-125071: Null Pointer Dereference
FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in libavcodec/jvdec.c that allows attackers to crash applications by supplying oversized JV video packets. Attackers can pass a roughly 268435460-byte packet through the libavcodec API, overflowing the bit count so decodeframe() reads from a NULL buffer and causes denial of service.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this denial-of-service issue?
Applications that use FFmpeg's libavcodec API to decode JV video packets are exposed if they can be made to process an oversized packet. The reported impact is an application crash, affecting availability rather than confidentiality or integrity.
What must an attacker provide to trigger the crash?
An attacker must supply a roughly 268435460-byte JV video packet through the libavcodec API. Processing this packet overflows the bit count, leading decode_frame() to read from a NULL buffer.
Does exploitation require authentication or user interaction?
The supplied vector indicates no privileges are required, but user interaction is required. The issue also has high attack complexity and depends on a specific precondition.