CVE-2026-125183
FFmpeg through 9.0.2 Denial of Service via HEVC PPS 3D Extension Parsing
CVSS Score
5.5
EPSS Score
0.0%
EPSS Percentile
0th
FFmpeg through 9.0.2 contains a denial of service vulnerability in pps_3d_extension() in libavcodec/hevc/ps.c that allows attackers to exhaust CPU through unbounded depth lookup table loops. Attackers can supply crafted HEVC files with repeated PPS NAL units that trigger hundreds of millions of bit skips, stalling decoders, parsers, and ffprobe.
| CWE | CWE-834 |
| Vendor | ffmpeg |
| Product | ffmpeg |
| Published | Nov 9, 2026 |
Stay Ahead of the Next One
Get instant alerts for ffmpeg ffmpeg
Be the first to know when new medium vulnerabilities affecting ffmpeg ffmpeg are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Affected Versions
FFmpeg / FFmpeg
0 ≤ 9.0.2
References
code.ffmpeg.org: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25572 github.com: https://github.com/FFmpeg/FFmpeg/commit/f9f732b444a2fc27dcc4fe52084d3d435f827864 github.com: https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/hevc/ps.c#L1963 github.com: https://github.com/FFmpeg/FFmpeg vulncheck.com: https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-denial-of-service-via-hevc-pps-3d-extension-parsing
Credits
Joshua Rogers (AISLE Research) Michael Niedermayer