UBUNTU-CVE-2026-125244: High severity ubuntu/ffmpeg vulnerability

Published Nov 10, 2026

Updated

FFmpeg before 8.1.3 and 9.x before 9.0.2 contains an out-of-bounds write vulnerability in the VVC decoder's shentrypoints() function in libavcodec/vvc/ps.c. Attackers can supply a crafted VVC (H.266) bitstream whose SPS/PPS tile and WPP layout produces excess entry points, overflowing entrypointstartctu and corrupting decoder memory.

Affected Software

7 affected components

ubuntu/ffmpeg*

Event History

Nov 10, 2026

CVE Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

What must an attacker provide to trigger this issue?

The attacker must cause FFmpeg's VVC decoder to process a crafted VVC (H.266) bitstream. The malicious SPS/PPS tile and WPP layout supplies excess entry points, causing an out-of-bounds write and decoder memory corruption.

Is user interaction required?

Yes. The supplied vector indicates UI:P, meaning user interaction is required. The vulnerability is locally exploitable with low attack complexity and does not require privileges.

Which FFmpeg releases are affected?

FFmpeg releases before 8.1.3 are affected, as are 9.x releases before 9.0.2. The provided data does not identify the specific Ubuntu package versions containing fixes.

UBUNTU-CVE-2026-125244: High severity ubuntu/ffmpeg vulnerability

Affected Software

Event History

Frequently Asked Questions

What must an attacker provide to trigger this issue?

Is user interaction required?

Which FFmpeg releases are affected?

Company

Resources

Contact

Frequently Asked Questions

What must an attacker provide to trigger this issue?

Is user interaction required?

Which FFmpeg releases are affected?