CVE-2026-125258

Description

FFmpeg through 9.0.2 contains a division by zero vulnerability in dovi_configure_ext() in libavcodec/dovi_rpuenc.c that allows attackers to crash the process via an unvalidated frame rate denominator. Attackers can supply a crafted HEVC or AV1 input with a nonzero frame rate numerator and zero denominator to the dovi_rpu bitstream filter or libx265, libaom, or libsvtav1 encoders, causing denial of service.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

References

• https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25408 ↗
• https://github.com/FFmpeg/FFmpeg/commit/ab28d57ba2ec07b41b4a60ed8806b13a39ec86fe ↗
• https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/dovi_rpuenc.c#L187 ↗
• https://github.com/FFmpeg/FFmpeg ↗
• https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-division-by-zero-via-dovi-configure-ext-in-dovi-rpuenc-c ↗