CVE-2026-125172

Description

FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in libxevd_receive_frame() in libavcodec/libxevd.c that fails to validate NAL unit length prefixes against remaining packet data. Attackers can supply crafted EVC media with oversized 4-byte NAL length prefixes, causing libxevd to read past the packet buffer, crashing the application or exposing adjacent heap memory.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

References

• https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25416 ↗
• https://github.com/FFmpeg/FFmpeg/commit/e06b3953d4253f8b56271628ba4083fde96aeadb ↗
• https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/libxevd.c#L355 ↗
• https://github.com/FFmpeg/FFmpeg ↗
• https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-out-of-bounds-read-via-libxevd-evc-nal-length ↗