UBUNTU-CVE-2026-125254: Medium severity ubuntu/ffmpeg vulnerability

Published Nov 10, 2026

Updated

FFmpeg through 9.0.2 contains a division by zero vulnerability in the VVC decoder because ffvvcslicerpl() fails to validate numrefidxactive against built reference list entries. Attackers can supply a crafted VVC bitstream whose excess reference indices yield a zero POC difference in ffvvcmvscale(), crashing the decoding process.

Affected Software

7 affected components

ubuntu/ffmpeg*

Event History

Nov 10, 2026

CVE Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who is exposed to this issue?

Systems that use the affected Ubuntu FFmpeg package to decode VVC bitstreams are exposed. The stated impact is a crash of the decoding process, with availability affected and no confidentiality or integrity impact indicated.

What does an attacker need to exploit it?

An attacker needs to provide a crafted VVC bitstream that causes excess reference indices and a zero POC difference during motion-vector scaling. The vector is local and user interaction is required according to the supplied severity data.

How can I tell whether a crash may be caused by this vulnerability?

The relevant condition is a crash while decoding a crafted or untrusted VVC bitstream. The affected code path involves ff_vvc_slice_rpl() accepting num_ref_idx_active values beyond the built reference list entries, followed by a division by zero in ff_vvc_mv_scale().

UBUNTU-CVE-2026-125254: Medium severity ubuntu/ffmpeg vulnerability

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

How can I tell whether a crash may be caused by this vulnerability?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

How can I tell whether a crash may be caused by this vulnerability?