CVE-2026-125221

Description

FFmpeg through 9.0.2 contains an uncontrolled recursion vulnerability in score_header() in libavcodec/flac_parser.c that allows attackers to exhaust the thread stack via crafted FLAC input. Attackers can supply a FLAC stream packed with many small valid-looking frame headers, forcing deep recursion that crashes the process during demuxing or parsing.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

References

• https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25569 ↗
• https://github.com/FFmpeg/FFmpeg/commit/972fe1ccd326538fe9a6b5d5094b7880b5443429 ↗
• https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/flac_parser.c#L603 ↗
• https://github.com/FFmpeg/FFmpeg ↗
• https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-uncontrolled-recursion-in-flac-parser-score-header ↗