CVE-2026-125185
MEDIUM
MEDIUM
Priority: 0.01
BB Relevance:
39/100
Published: 2026-11-09
Modified: 2026-11-10
First seen: 2026-11-09
Status: active
Attack Surface
Low Complexity
No Auth
CVSS Vector Breakdown
AV:
Local
AC:
Low
PR:
None
UI:
Passive
S:
X
AT:
None
VC:
None
VI:
None
VA:
High
Description
FFmpeg through 9.0.2 contains a division by zero vulnerability in ff_aom_parse_film_grain_sets() that fails to reject AFGS1 scaling points with repeated x values. Attackers can supply crafted HEVC or VVC files with zero-increment scaling points in T.35 SEI messages, causing generate_scaling() to divide by zero and crash the decoder.