← Database

CVE-2026-125072

MEDIUM CVSS: 4.7 Published: 2026-11-09 Modified: 2026-11-09

Description

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in mp_decode_frame() in libavcodec/mpegaudiodec_template.c because init_get_bits() failure is ignored after a signed integer overflow. Attackers can pass an oversized packet to the mp3adu decoder through the libavcodec API, causing reads through a NULL buffer that crash the process.

Affected Platforms

Unknown

Weakness Type

CWE-252

References