CVE-2026-125258 FFmpeg through 9.0.2 Division by Zero via dovi_configure_ext() in dovi_rpuenc.c
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-125258?
CVE-2026-125258 is a medium-severity vulnerability in FFmpeg, published on 9 Nov 2026.
Official description
FFmpeg through 9.0.2 contains a division by zero vulnerability in dovi_configure_ext() in libavcodec/dovi_rpuenc.c that allows attackers to crash the process via an unvalidated frame rate denominator. Attackers can supply a crafted HEVC or AV1 input with a nonzero frame rate numerator and zero denominator to the dovi_rpu bitstream filter or libx265, libaom, or libsvtav1 encoders, causing denial of service.
Weakness: CWE-369
Which versions are affected by CVE-2026-125258?
How do I fix CVE-2026-125258?
No fix has been published for CVE-2026-125258 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-125258 being exploited?
There is no known exploitation of CVE-2026-125258 in the wild and no public exploit code.
Sources
Also known as GHSA-8qc4-38fg-fxc3, UBUNTU-CVE-2026-125258.