UBUNTU-CVE-2026-125231: Null Pointer Dereference
FFmpeg 4.4 through 9.0.2 contains a NULL pointer dereference vulnerability in libavcodec/adxdec.c because adxdecodeheader() updates the channel layout before validating the sample rate. Attackers can supply a crafted ADX/AAX stream with mid-stream new-extradata side data carrying an invalid sample rate, causing adxdecode() to write through NULL plane pointers and crash the application.
Affected Software
Event History
Frequently Asked Questions
What conditions are required to trigger the crash?
An attacker must provide a crafted ADX or AAX stream that includes mid-stream new-extradata side data with an invalid sample rate. Exploitation requires user interaction to process the malicious stream, while the attacker does not need privileges.
What is the expected impact?
The vulnerable decoder can write through NULL plane pointers and crash the application. The supplied severity vector indicates availability impact only; no confidentiality or integrity impact is identified.
Which FFmpeg versions are affected?
FFmpeg versions 4.4 through 9.0.2 are identified as affected.