UBUNTU-CVE-2026-125183: Medium severity ubuntu/ffmpeg vulnerability
FFmpeg through 9.0.2 contains a denial of service vulnerability in pps3dextension() in libavcodec/hevc/ps.c that allows attackers to exhaust CPU through unbounded depth lookup table loops. Attackers can supply crafted HEVC files with repeated PPS NAL units that trigger hundreds of millions of bit skips, stalling decoders, parsers, and ffprobe.
Affected Software
Event History
Frequently Asked Questions
Which Ubuntu systems are exposed?
Ubuntu systems using the ffmpeg package are exposed if they process attacker-supplied HEVC files. The affected FFmpeg range is through 9.0.2.
What does an attacker need to exploit this issue?
An attacker needs to provide a crafted HEVC file containing repeated PPS NAL units. Exploitation requires a user or process to decode, parse, or inspect the file, including with ffprobe.
Is this a confidentiality or integrity issue?
The reported impact is denial of service through CPU exhaustion. The supplied vector indicates no confidentiality or integrity impact, while availability impact is high.
What can be done while patching is unavailable?
Avoid decoding, parsing, or running ffprobe against untrusted HEVC files, particularly in automated processing workflows. Restrict processing of externally supplied media to reduce exposure.