CVE-2026-125215 FFmpeg 7.1 through 9.0.2 NULL Pointer Dereference via ff_dovi_rpu_generate()
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-125215?
CVE-2026-125215 is a medium-severity vulnerability in FFmpeg, published on 9 Nov 2026.
Official description
FFmpeg 7.1 through 9.0.2 contains a NULL pointer dereference vulnerability in ff_dovi_rpu_generate() in libavcodec/dovi_rpuenc.c that allows attackers to crash applications via crafted Dolby Vision RPU metadata. Attackers can supply streams with default or alternating omitted DM blocks to the dovi_rpu bitstream filter with compression enabled, causing denial of service.
Weakness: CWE-476
Which versions are affected by CVE-2026-125215?
How do I fix CVE-2026-125215?
No fix has been published for CVE-2026-125215 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-125215 being exploited?
There is no known exploitation of CVE-2026-125215 in the wild and no public exploit code.
Sources
Also known as GHSA-q7f2-7mqp-27x9, UBUNTU-CVE-2026-125215.