UBUNTU-CVE-2026-125172: Medium severity ubuntu/ffmpeg vulnerability

Published Nov 10, 2026

Updated

FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in libxevdreceiveframe() in libavcodec/libxevd.c that fails to validate NAL unit length prefixes against remaining packet data. Attackers can supply crafted EVC media with oversized 4-byte NAL length prefixes, causing libxevd to read past the packet buffer, crashing the application or exposing adjacent heap memory.

Affected Software

7 affected components

ubuntu/ffmpeg*

Event History

Nov 10, 2026

CVE Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

What must an attacker provide to trigger this issue?

An attacker must cause the application to process crafted EVC media containing oversized 4-byte NAL unit length prefixes. User interaction is required according to the supplied severity vector.

What is the likely impact on an affected application?

Processing the crafted media can cause libxevd to read beyond the packet buffer. This may crash the application or expose adjacent heap memory.

Which component should be checked when assessing exposure?

Check whether the application uses FFmpeg's libxevd decoder and processes EVC media. The vulnerable function is libxevd_receive_frame() in libavcodec/libxevd.c.

UBUNTU-CVE-2026-125172: Medium severity ubuntu/ffmpeg vulnerability

Affected Software

Event History

Frequently Asked Questions

What must an attacker provide to trigger this issue?

What is the likely impact on an affected application?

Which component should be checked when assessing exposure?

Company

Resources

Contact

Frequently Asked Questions

What must an attacker provide to trigger this issue?

What is the likely impact on an affected application?

Which component should be checked when assessing exposure?