UBUNTU-CVE-2026-125187: Medium severity ubuntu/ffmpeg vulnerability
FFmpeg through 9.0.2 contains a reachable assertion vulnerability in the TTA encoder's ttaencodeframe() in libavcodec/ttaenc.c, which never reserves output packet space for the 4-byte CRC. Attackers can supply audio whose sample values and length produce a small, poorly compressible final frame, triggering the avassert0() in flushputbits() and aborting applications transcoding to TTA.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications on Ubuntu using FFmpeg to transcode attacker-controlled or otherwise untrusted audio into TTA are exposed. The impact is an application abort and denial of service during encoding.
What does an attacker need to exploit it?
An attacker needs to provide audio with sample values and a length that produce a small, poorly compressible final TTA frame. No attacker privileges are required, but user interaction is required according to the supplied severity vector.
Are default FFmpeg deployments affected?
The issue is in the TTA encoder, so it applies when the affected application is configured to transcode audio to TTA. The provided data does not establish that TTA encoding is enabled or used by default.
How can I determine whether an application is affected?
Check whether the application uses FFmpeg through version 9.0.2 and encodes untrusted audio to TTA. Affected processing may abort in flush_put_bits() after reaching the assertion while encoding the final frame.