CVE-2026-125215
MEDIUM
NVD
CVSS Score
4.7
Severity
MEDIUM
Published
Nov 09, 2026
Vendor
unknown
Description
FFmpeg 7.1 through 9.0.2 contains a NULL pointer dereference vulnerability in ff_dovi_rpu_generate() in libavcodec/dovi_rpuenc.c that allows attackers to crash applications via crafted Dolby Vision RPU metadata. Attackers can supply streams with default or alternating omitted DM blocks to the dovi_rpu bitstream filter with compression enabled, causing denial of service.