CVE-2026-125232

MEDIUM 5.5

FFmpeg through 9.0.2 Division by Zero in B-frame Motion Estimation

CVSS Score

5.5

EPSS Score

0.0%

EPSS Percentile

0th

FFmpeg through 9.0.2 contains a division by zero vulnerability in estimate_motion_b() in libavcodec/motion_est.c, caused by frame timestamp distances truncated to 16 bits. Attackers can supply input with timestamp gaps that are multiples of 65536, crashing MPEG-4 Part 2 or MPEG-1/2 B-frame encoding with SIGFPE.

CWE	CWE-369
Vendor	ffmpeg
Product	ffmpeg
Published	Nov 9, 2026

Stay Ahead of the Next One

Get instant alerts for ffmpeg ffmpeg

Be the first to know when new medium vulnerabilities affecting ffmpeg ffmpeg are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Affected Versions

FFmpeg / FFmpeg

0 ≤ 9.0.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

code.ffmpeg.org: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24552 github.com: https://github.com/FFmpeg/FFmpeg/commit/bf0a2e4680df92d8de6514090d350152eb7845b8 github.com: https://github.com/FFmpeg/FFmpeg/commit/16d19ccbce802634662a9bf18a5679cf27da2848 github.com: https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/motion_est.c#L1153 github.com: https://github.com/FFmpeg/FFmpeg vulncheck.com: https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-division-by-zero-in-b-frame-motion-estimation

Credits

Gabe Sherman (Trail of Bits) 🔍 Joshua Rogers (AISLE Research) Michael Niedermayer