CVE-2026-125238
Received Received - Intake

FFmpeg Assertion Failure in EVC Decoder

Publication date: 2026-11-09

Last updated on: 2026-11-09

Assigner: VulnCheck

Description
FFmpeg through 9.0.2 contains a reachable assertion vulnerability in libxevd_receive_frame() in libavcodec/libxevd.c that returns success when an access unit produces no frame. Attackers can supply a crafted EVC file with truncated or picture-less access units to trigger the av_assert0() on frame->private_ref, aborting any decoding application.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-09
Last Modified
2026-11-09
Generated
2026-11-09
AI Q&A
2026-11-09
EPSS Evaluated
N/A
NVD
CVE-2026-125238
EUVD
EUVD-2026-120188

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
FFmpeg FFmpeg From 7.0 (inc) to 9.0.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-617 The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a reachable assertion flaw in FFmpeg through version 9.0.2. It occurs in the libxevd EVC decoder wrapper function libxevd_receive_frame(). The issue happens when an access unit produces no frame but the code incorrectly returns success. Attackers can exploit this by providing a maliciously crafted EVC file with truncated or picture-less access units, triggering an assertion failure that aborts any decoding application using FFmpeg.

Detection Guidance

Detecting this vulnerability requires checking for FFmpeg versions 7.0 through 9.0.2. Use commands like 'ffmpeg -version' to identify installed versions. Monitor for crashes when processing EVC files, as the vulnerability triggers assertion failures during decoding.

Impact Analysis

This vulnerability can cause denial of service by crashing applications that use FFmpeg for decoding EVC video files. If an attacker provides a specially crafted file, it could force the application to abort unexpectedly, disrupting media processing tasks or services relying on FFmpeg.

Mitigation Strategies

Upgrade FFmpeg to the patched version in the n9.0.2 branch or later. Apply the commit 33b0107 fix which changes the decoder to return EAGAIN instead of success for empty access units. Avoid processing untrusted EVC files until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-125238. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...