CVE-2026-125215

Description

FFmpeg 7.1 through 9.0.2 contains a NULL pointer dereference vulnerability in ff_dovi_rpu_generate() in libavcodec/dovi_rpuenc.c that allows attackers to crash applications via crafted Dolby Vision RPU metadata. Attackers can supply streams with default or alternating omitted DM blocks to the dovi_rpu bitstream filter with compression enabled, causing denial of service.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

References

• https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24514 ↗
• https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25606 ↗
• https://github.com/FFmpeg/FFmpeg/commit/971ea9d6a2a9ae4c770936f0569cf40720d4c304 ↗
• https://github.com/FFmpeg/FFmpeg/commit/11c4b420183cb2d6cd4afaa53de57d400a45e09e ↗
• https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/dovi_rpuenc.c#L741 ↗
• https://github.com/FFmpeg/FFmpeg ↗
• https://www.vulncheck.com/advisories/ffmpeg-7.1-through-9.0.2-null-pointer-dereference-via-ff-dovi-rpu-generate ↗