CVE-2026-125231 FFmpeg 4.4 through 9.0.2 NULL Pointer Dereference via adx_decode_header()

Medium 6.8 Published 9 Nov 2026 Updated 9 Nov 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2026-125231?

CVE-2026-125231 is a medium-severity vulnerability in FFmpeg, published on 9 Nov 2026.

Official description

FFmpeg 4.4 through 9.0.2 contains a NULL pointer dereference vulnerability in libavcodec/adxdec.c because adx_decode_header() updates the channel layout before validating the sample rate. Attackers can supply a crafted ADX/AAX stream with mid-stream new-extradata side data carrying an invalid sample rate, causing adx_decode() to write through NULL plane pointers and crash the application.

Weakness: CWE-476

Which versions are affected by CVE-2026-125231?

How do I fix CVE-2026-125231?

No fix has been published for CVE-2026-125231 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-125231 being exploited?

There is no known exploitation of CVE-2026-125231 in the wild and no public exploit code.

Sources

Also known as GHSA-mv8m-365q-44g4, UBUNTU-CVE-2026-125231.