CVE-2026-125183
Discovered by AISLEPUBLISHEDCWE-834
Description
FFmpeg through 9.0.2 contains a denial of service vulnerability in pps_3d_extension() in libavcodec/hevc/ps.c that allows attackers to exhaust CPU through unbounded depth lookup table loops. Attackers can supply crafted HEVC files with repeated PPS NAL units that trigger hundreds of millions of bit skips, stalling decoders, parsers, and ffprobe.
CVSS Base Scores
CVSS v4.06.8
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS v3.1
5.5CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Version | Status |
|---|---|---|---|
| FFmpeg | FFmpeg | 0 | affected |
Credits
- Joshua Rogers (AISLE Research)(finder)
- Michael Niedermayer(remediation developer)
References
- https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25572
- https://github.com/FFmpeg/FFmpeg/commit/f9f732b444a2fc27dcc4fe52084d3d435f827864
- https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/hevc/ps.c#L1963
- https://github.com/FFmpeg/FFmpeg
- https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-denial-of-service-via-hevc-pps-3d-extension-parsing