CVE-2026-125073

MEDIUM 5.5

FFmpeg through 9.0.2 Infinite Loop Denial of Service via IMC/IAC Decoder

CVSS Score

5.5

EPSS Score

0.0%

EPSS Percentile

0th

FFmpeg through 9.0.2 contains an infinite loop vulnerability in bit_allocation() in libavcodec/imc.c that allows attackers to hang decoding by supplying audio blocks with a negative bit budget. Attackers can craft IMC or IAC audio files that drive freebits negative, causing the reduction loop to never terminate and consuming 100% CPU.

CWE	CWE-835
Vendor	ffmpeg
Product	ffmpeg
Published	Nov 9, 2026

Stay Ahead of the Next One

Get instant alerts for ffmpeg ffmpeg

Be the first to know when new medium vulnerabilities affecting ffmpeg ffmpeg are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Affected Versions

FFmpeg / FFmpeg

0 ≤ 9.0.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

code.ffmpeg.org: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25696 github.com: https://github.com/FFmpeg/FFmpeg/commit/9b26bb4c9a4457d480899a1bf64ec080eceb1acd github.com: https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/imc.c#L572 github.com: https://github.com/FFmpeg/FFmpeg vulncheck.com: https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-infinite-loop-denial-of-service-via-imc-iac-decoder

Credits

Joshua Rogers (AISLE Research) Michael Niedermayer