UBUNTU-CVE-2026-125185: Divide by Zero

Published Nov 10, 2026

Updated

FFmpeg through 9.0.2 contains a division by zero vulnerability in ffaomparsefilmgrainsets() that fails to reject AFGS1 scaling points with repeated x values. Attackers can supply crafted HEVC or VVC files with zero-increment scaling points in T.35 SEI messages, causing generatescaling() to divide by zero and crash the decoder.

Affected Software

7 affected components

ubuntu/ffmpeg*

Event History

Nov 10, 2026

CVE Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments using the affected FFmpeg decoder to process HEVC or VVC media are exposed when they handle attacker-supplied files containing T.35 SEI messages.

What must an attacker do to trigger the vulnerability?

The attacker must provide a crafted HEVC or VVC file with AFGS1 scaling points that use repeated x values, producing zero-increment scaling points. Processing that file can cause the decoder to crash.

What is the expected security impact?

The provided vector and description indicate an availability impact: division by zero can crash the decoder. No confidentiality or integrity impact is stated.

UBUNTU-CVE-2026-125185: Divide by Zero

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What must an attacker do to trigger the vulnerability?

What is the expected security impact?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What must an attacker do to trigger the vulnerability?

What is the expected security impact?