CVE-2026-125183

EUVD-2026-120272
FFmpeg through 9.0.2 contains a denial of service vulnerability in pps_3d_extension() in libavcodec/hevc/ps.c that allows attackers to exhaust CPU through unbounded depth lookup table loops. Attackers can supply crafted HEVC files with repeated PPS NAL units that trigger hundreds of millions of bit skips, stalling decoders, parsers, and ffprobe.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
5.5 MEDIUM
LOCAL
LOW
NONE
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).
VendorProductVersionSource
ffmpegffmpeg
𝑥
≤ 9.0.2
CNA
Common Weakness Enumeration
References
https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25572
https://github.com/FFmpeg/FFmpeg
https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/hevc/ps.c#L1963
https://github.com/FFmpeg/FFmpeg/commit/f9f732b444a2fc27dcc4fe52084d3d435f827864
https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-denial-of-service-via-hevc-pps-3d-extension-parsing