UBUNTU-CVE-2026-125232: Medium severity ubuntu/ffmpeg vulnerability

Published Nov 10, 2026

Updated

FFmpeg through 9.0.2 contains a division by zero vulnerability in estimatemotionb() in libavcodec/motionest.c, caused by frame timestamp distances truncated to 16 bits. Attackers can supply input with timestamp gaps that are multiples of 65536, crashing MPEG-4 Part 2 or MPEG-1/2 B-frame encoding with SIGFPE.

Affected Software

7 affected components

ubuntu/ffmpeg*

Event History

Nov 10, 2026

CVE Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who is exposed to this issue?

Systems that use the affected FFmpeg code to encode MPEG-4 Part 2 or MPEG-1/2 video with B-frames are exposed. The issue is triggered during encoding rather than by general FFmpeg use.

What must an attacker provide to trigger the crash?

An attacker must be able to supply input whose frame timestamp gaps are multiples of 65,536. User interaction is required according to the supplied severity vector, while no privileges are required.

What is the practical impact of successful exploitation?

Successful exploitation causes a division by zero in estimate_motion_b() and terminates the encoding process with SIGFPE. The supplied impact ratings indicate availability impact only, with no indicated confidentiality or integrity impact.

UBUNTU-CVE-2026-125232: Medium severity ubuntu/ffmpeg vulnerability

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this issue?

What must an attacker provide to trigger the crash?

What is the practical impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What must an attacker provide to trigger the crash?

What is the practical impact of successful exploitation?