CVE-2026-125070

Description

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in tqi_decode_frame() in libavcodec/eatqi.c, which ignores init_get_bits() failure after an integer overflow. Attackers can supply a crafted EA file with a pIQT chunk carrying a 2^28-byte payload to crash the process, causing denial of service.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

References

• https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25704 ↗
• https://github.com/FFmpeg/FFmpeg/commit/5d7b743bdfb724df21fd43a3d7f3258382eb578c ↗
• https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/eatqi.c#L154 ↗
• https://github.com/FFmpeg/FFmpeg ↗
• https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-null-pointer-dereference-in-ea-tqi-decoder ↗