CVE-2026-125231Medium· 5.5▾ SunlitFFmpeg 4.4 through 9.0.2 contains a NULL pointer dereference vulnerability in libavcodec/adxdec.c because adx_decode_header() updates the channel layout before validating the sample rate. Attackers can supply a crafted ADX/AAX stream wit…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 30.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
FFmpeg 4.4 through 9.0.2 contains a NULL pointer dereference vulnerability in libavcodec/adxdec.c because adx_decode_header() updates the channel layout before validating the sample rate. Attackers can supply a crafted ADX/AAX stream with mid-stream new-extradata side data carrying an invalid sample rate, causing adx_decode() to write through NULL plane pointers and crash the application.
FFmpeg >= 4.4 <= 9.0.2Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-125102Low· 3.3FFmpeg through 9.0.2 TAK Decoder Uninitialized Memory Disclosure via takdec.c
CVE-2026-125103Low· 3.3FFmpeg through 9.0.2 Uninitialized Heap Disclosure via MLZ Decompressor in ALS Decoder
CVE-2026-125207Medium· 5.5FFmpeg through 9.0.2 Excessive Memory Allocation via Interplay ACM Decoder
CVE-2026-125216Medium· 5.5FFmpeg through 9.0.2 DPX Encoder NULL Pointer Dereference via encode_gbrp12()
CVE-2026-125215Medium· 4.7FFmpeg 7.1 through 9.0.2 NULL Pointer Dereference via ff_dovi_rpu_generate()
CVE-2026-125226Medium· 5.5FFmpeg through 9.0.2 Excessive Memory Allocation via SBaGen Demuxer