CVE-2026-125225
Received Received - Intake

FFmpeg 9.0.2 NULL Pointer Dereference in ADTS AAC Processing

Publication date: 2026-11-09

Last updated on: 2026-11-09

Assigner: VulnCheck

Description
FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in aac_adtstoasc_filter() that allows attackers to crash applications via oversized ADTS AAC packets. Attackers can supply a crafted file with a packet over 256 MB, overflowing the bit count so init_get_bits() fails unchecked and get_bits() crashes during MP4, Matroska, FLV or LATM remuxing.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-09
Last Modified
2026-11-09
Generated
2026-11-09
AI Q&A
2026-11-09
EPSS Evaluated
N/A
NVD
CVE-2026-125225
EUVD
EUVD-2026-120175

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
FFmpeg FFmpeg From 0 (inc) to 9.0.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-252 The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

FFmpeg through version 9.0.2 has a NULL pointer dereference flaw in the aac_adtstoasc_filter() function. Attackers exploit this by providing oversized ADTS AAC packets, specifically over 256 MB, which causes init_get_bits() to fail without proper checks. This leads to a crash when get_bits() is called during remuxing operations in formats like MP4, Matroska, FLV, or LATM.

Detection Guidance

Detecting this vulnerability requires analyzing FFmpeg versions and processing media files. Check FFmpeg version with 'ffmpeg -version' and look for versions through 9.0.2. Monitor for crashes during media file processing, especially with ADTS AAC packets. Use network monitoring tools to inspect for oversized packets over 256 MB.

Impact Analysis

This vulnerability can crash applications processing media files, leading to denial of service. If exploited, it may disrupt services relying on FFmpeg for media handling, such as video streaming or file conversion tools.

Mitigation Strategies

Immediately update FFmpeg to a version beyond 9.0.2. Disable or restrict media processing capabilities if updates are not immediately possible. Implement network monitoring to block or alert on oversized ADTS AAC packets. Review and restrict user permissions for media file processing.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-125225. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...