Medium severity5.5NVD Advisory· Published Nov 9, 2026

CVE-2026-125183

Description

FFmpeg through 9.0.2 contains a denial of service vulnerability in pps_3d_extension() in libavcodec/hevc/ps.c that allows attackers to exhaust CPU through unbounded depth lookup table loops. Attackers can supply crafted HEVC files with repeated PPS NAL units that trigger hundreds of millions of bit skips, stalling decoders, parsers, and ffprobe.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

FFmpeg/Ffmpegllm-fuzzy
Range: <=9.0.2

Patches

Vulnerability mechanics

References

code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25572nvd
github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/hevc/ps.cnvd
github.com/FFmpeg/FFmpeg/commit/f9f732b444a2fc27dcc4fe52084d3d435f827864nvd
www.vulncheck.com/advisories/ffmpeg-through-9.0.2-denial-of-service-via-hevc-pps-3d-extension-parsingnvd

News mentions

No linked articles in our index yet.

cvss	0.358
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000