UBUNTU-CVE-2026-125073: Medium severity ubuntu/ffmpeg vulnerability
FFmpeg through 9.0.2 contains an infinite loop vulnerability in bitallocation() in libavcodec/imc.c that allows attackers to hang decoding by supplying audio blocks with a negative bit budget. Attackers can craft IMC or IAC audio files that drive freebits negative, causing the reduction loop to never terminate and consuming 100% CPU.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using FFmpeg through version 9.0.2 to decode IMC or IAC audio are exposed, particularly where those audio files can be supplied by untrusted sources.
What does an attacker need to do to trigger the issue?
An attacker needs to provide a crafted IMC or IAC audio file containing blocks that cause the bit budget to become negative. Exploitation requires the file to be decoded; the supplied vector indicates no privileges are required but user interaction is required.
What is the practical impact of successful exploitation?
The affected decoding operation can enter a non-terminating reduction loop and consume 100% CPU. This can hang decoding and cause an availability impact for the affected process or service.
How can I determine whether I may be affected?
Check whether the Ubuntu FFmpeg package in use includes FFmpeg version 9.0.2 or an earlier version and whether it decodes IMC or IAC audio. The provided data does not identify a fixed Ubuntu package version.