CVE-2026-125104
Received Received - Intake

Memory Exhaustion in FFmpeg via APE Decoder

Publication date: 2026-11-09

Last updated on: 2026-11-09

Assigner: VulnCheck

Description
FFmpeg through 9.0.2 contains a memory exhaustion vulnerability in ape_decode_frame() in libavcodec/apedec.c that fails to enforce the 73728-sample limit for legacy APE frames. Attackers can supply a crafted legacy Monkey's Audio file declaring an enormous nblocks value to force gigabyte-scale allocations and cause denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-09
Last Modified
2026-11-09
Generated
2026-11-09
AI Q&A
2026-11-09
EPSS Evaluated
N/A
NVD
CVE-2026-125104
EUVD
EUVD-2026-120258

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
FFmpeg FFmpeg From 0 (inc) to 9.0.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-789 The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a memory exhaustion vulnerability in FFmpeg through version 9.0.2. It occurs in the APE decoder where the ape_decode_frame() function fails to enforce a 73728-sample limit for legacy APE frames. Attackers can exploit this by providing a crafted Monkey's Audio file with an enormous nblocks value, causing gigabyte-scale memory allocations and denial of service.

Detection Guidance

To detect this vulnerability, monitor for unusual memory usage spikes when processing APE audio files. Use tools like 'top' or 'htop' to check memory consumption during file processing. Additionally, inspect FFmpeg logs for errors related to memory allocation failures or invalid data handling in the APE decoder.

Impact Analysis

This vulnerability can cause system resource exhaustion leading to denial of service. An attacker could crash applications or systems by supplying a maliciously crafted APE file, potentially disrupting services that rely on FFmpeg for media processing.

Mitigation Strategies

Immediately update FFmpeg to a patched version that enforces the 73,728-sample limit for legacy APE frames. If updating is not possible, restrict processing of APE files from untrusted sources or disable the APE decoder module entirely until a patch is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-125104. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...