---
id: CVE-2026-125183
title: FFmpeg through 9.0.2 Denial of Service via HEVC PPS 3D Extension Parsing
summary: >-
  FFmpeg through 9.0.2 contains a denial of service vulnerability in
  pps_3d_extension() in libavcodec/hevc/ps.c that allows attackers to exhaust
  CPU through unbounded depth lookup table loops. Attackers can supply crafted
  HEVC files with r…
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'
cvssSource: cna
cwe:
  - CWE-834
vendor: FFmpeg
product: FFmpeg
affected:
  - FFmpeg <= 9.0.2
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-09T21:03:16.271412Z'
published: '2026-11-09'
updated: '2026-11-09'
sourceUpdated: '2026-11-09T21:06:58.037Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-125183'
references:
  - url: 'https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25572'
  - url: >-
      https://github.com/FFmpeg/FFmpeg/commit/f9f732b444a2fc27dcc4fe52084d3d435f827864
    label: Patch Commit
  - url: 'https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/hevc/ps.c#L1963'
  - url: 'https://github.com/FFmpeg/FFmpeg'
  - url: >-
      https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-denial-of-service-via-hevc-pps-3d-extension-parsing
    label: >-
      VulnCheck Advisory: FFmpeg through 9.0.2 Denial of Service via HEVC PPS 3D
      Extension Parsing
tags:
  - cve.org
ingestedAt: '2026-11-09T19:18:02.612Z'
---

## Overview

FFmpeg through 9.0.2 contains a denial of service vulnerability in pps_3d_extension() in libavcodec/hevc/ps.c that allows attackers to exhaust CPU through unbounded depth lookup table loops. Attackers can supply crafted HEVC files with repeated PPS NAL units that trigger hundreds of millions of bit skips, stalling decoders, parsers, and ffprobe.

## Affected

- `FFmpeg <= 9.0.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.