CVE-2026-125216
Received Received - Intake

NULL Pointer Dereference in FFmpeg via DPX Encoder

Publication date: 2026-11-09

Last updated on: 2026-11-09

Assigner: VulnCheck

Description
FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in libavcodec/dpxenc.c that allows attackers to crash the process via unvalidated bits_per_raw_sample for RGB48 input. Attackers can supply a 12-bit RGB image, such as JPEG 2000, that when transcoded to DPX selects encode_gbrp12() and dereferences NULL plane pointers, causing denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-09
Last Modified
2026-11-09
Generated
2026-11-09
AI Q&A
2026-11-09
EPSS Evaluated
N/A
NVD
CVE-2026-125216
EUVD
EUVD-2026-120305

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
FFmpeg FFmpeg From 0 (inc) to 9.0.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-476 The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

FFmpeg through version 9.0.2 has a NULL pointer dereference flaw in libavcodec/dpxenc.c. When processing RGB48 input with unvalidated bits_per_raw_sample, attackers can provide a 12-bit RGB image like JPEG 2000. Transcoding this to DPX triggers encode_gbrp12() which dereferences NULL plane pointers, causing a denial of service by crashing the application.

Impact Analysis

This vulnerability can cause applications using FFmpeg to crash, leading to denial of service. If exploited, it may disrupt media processing workflows, corrupt files, or require restarting affected services. Local attackers with access to input files could trigger the crash.

Mitigation Strategies

Upgrade FFmpeg to a version later than 9.0.2 to address the NULL pointer dereference issue in libavcodec/dpxenc.c.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-125216. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...