CVE-2026-125183
Received Received - Intake

Denial of Service in FFmpeg via HEVC PPS NAL Unit Exploit

Publication date: 2026-11-09

Last updated on: 2026-11-09

Assigner: VulnCheck

Description
FFmpeg through 9.0.2 contains a denial of service vulnerability in pps_3d_extension() in libavcodec/hevc/ps.c that allows attackers to exhaust CPU through unbounded depth lookup table loops. Attackers can supply crafted HEVC files with repeated PPS NAL units that trigger hundreds of millions of bit skips, stalling decoders, parsers, and ffprobe.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-09
Last Modified
2026-11-09
Generated
2026-11-09
AI Q&A
2026-11-09
EPSS Evaluated
N/A
NVD
CVE-2026-125183
EUVD
EUVD-2026-120272

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
FFmpeg FFmpeg From 0 (inc) to 9.0.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-834 The product performs an iteration or loop without sufficiently limiting the number of times that the loop is executed.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a denial of service vulnerability in FFmpeg versions up to 9.0.2. It exists in the pps_3d_extension() function within libavcodec/hevc/ps.c. Attackers exploit it by providing specially crafted HEVC video files containing repeated PPS NAL units. These files trigger excessive bit skips in depth lookup table loops, causing CPU exhaustion and stalling decoders, parsers, and ffprobe tools.

Detection Guidance

Detecting this vulnerability requires analyzing FFmpeg versions and processing crafted HEVC files. Check FFmpeg version with 'ffmpeg -version' and look for versions through 9.0.2. Monitor CPU usage spikes during media processing. Use 'ffprobe' on suspicious files to check for repeated PPS NAL units. No direct network detection commands exist.

Impact Analysis

If you process untrusted HEVC video files with vulnerable FFmpeg versions, this flaw could allow attackers to crash your system or render it unresponsive by consuming excessive CPU resources. This affects applications that decode or analyze HEVC video content, including media players, video processing tools, and ffprobe utilities.

Mitigation Strategies

Upgrade FFmpeg to the latest version beyond 9.0.2 immediately. Avoid processing untrusted HEVC files until patched. Disable automatic media file processing in applications using FFmpeg. Monitor system resources for unusual CPU spikes during media operations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-125183. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...