CVE-2026-125174

MEDIUM 5.5

FFmpeg before 8.1.3 and 9.x before 9.0.2 NULL Pointer Dereference via ff_hap_set_chunk_count()

CVSS Score

5.5

EPSS Score

0.0%

EPSS Percentile

0th

FFmpeg before 8.1.3 and 9.x before 9.0.2 contains a NULL pointer dereference vulnerability in ff_hap_set_chunk_count() in libavcodec/hap.c, where a shadowed return variable masks reallocation failures. Attackers can supply a crafted Hap video frame with an oversized chunk count so the decoder writes through a NULL chunk table, crashing the application.

CWE	CWE-252
Vendor	ffmpeg
Product	ffmpeg
Published	Nov 9, 2026

Stay Ahead of the Next One

Get instant alerts for ffmpeg ffmpeg

Be the first to know when new medium vulnerabilities affecting ffmpeg ffmpeg are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Affected Versions

FFmpeg / FFmpeg

0 < 8.1.3 9.0 < 9.0.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

code.ffmpeg.org: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24487 github.com: https://github.com/FFmpeg/FFmpeg/commit/f8c4c6400e835bf65e8b9cc12aba9e5c4d1c818c github.com: https://github.com/FFmpeg/FFmpeg/blob/n9.0.1/libavcodec/hap.c#L33 github.com: https://github.com/FFmpeg/FFmpeg vulncheck.com: https://www.vulncheck.com/advisories/ffmpeg-before-8.1.3-and-9-x-before-9.0.2-null-pointer-dereference-via-ff-hap-set-chunk-count

Credits

Zheng Yu @ Depthfirst 🔍 Joshua Rogers (AISLE Research) Michael Niedermayer