MEDIUM 5.7 NVD
CVE-2026-125186
FFmpeg through 9.0.2 contains an uncontrolled resource consumption vulnerability in the dts2pts bitstream filter that allows attackers to exhaust CPU through un
FFmpeg through 9.0.2 contains an uncontrolled resource consumption vulnerability in the dts2pts bitstream filter that allows attackers to exhaust CPU through unbounded per-packet POC node allocation. Attackers can supply a crafted H.264 packet with many slices of alternating picture order counts, forcing h264_queue_frame() to allocate tree nodes per slice and deny service.
References
- https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25569
- https://github.com/FFmpeg/FFmpeg
- https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/bsf/dts2pts.c#L363
- https://github.com/FFmpeg/FFmpeg/commit/d8013c061725631261d7326c07d2af3a67fa4bc1
- https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-cpu-exhaustion-via-dts2pts-bitst
This medium severity vulnerability with a CVSS score of 5.7 was published on 2026-11-09 via NVD.
vulnfeed aggregates 17092 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.