CVE-2026-125183
5.5 MEDIUMpublic exploit availablePublished 2026-11-09 · Updated 2026-11-10
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
FFmpeg through 9.0.2 contains a denial of service vulnerability in pps_3d_extension() in libavcodec/hevc/ps.c that allows attackers to exhaust CPU through unbounded depth lookup table loops. Attackers can supply crafted HEVC files with repeated PPS NAL units that trigger hundreds of millions of bit skips, stalling decoders, parsers, and ffprobe.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weaknesses
CWE-834
Public exploit & PoC references
All references
- https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25572
- https://github.com/FFmpeg/FFmpeg
- https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/hevc/ps.c#L1963
- https://github.com/FFmpeg/FFmpeg/commit/f9f732b444a2fc27dcc4fe52084d3d435f827864
- https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-denial-of-service-via-hevc-pps-3d-extension-parsing
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- MEDIUMCVE-2026-106576PoC
- MEDIUMCVE-2026-110596PoC
- UNSCOREDCVE-2026-115580PoC
- MEDIUMCVE-2026-115911PoC
- UNSCOREDCVE-2026-53493PoC
- MEDIUMCVE-2026-77399PoC
- MEDIUMCVE-2026-81880PoC
- UNSCOREDCVE-2026-87721
Related by shared AI tags and CWE weakness class. Browse the full archive.