CVE-2026-125205
Received Received - Intake

Memory Exhaustion in FFmpeg AV1 OBU Filter

Publication date: 2026-11-09

Last updated on: 2026-11-09

Assigner: VulnCheck

Description
FFmpeg through 9.0.2 contains an unbounded memory allocation vulnerability in the av1_frame_merge bitstream filter that allows attackers to exhaust memory by never sending a temporal delimiter OBU. Attackers can supply a crafted .obu file opened by the AV1 OBU or Annex B demuxers, forcing unlimited OBU buffering per temporal unit and causing denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-09
Last Modified
2026-11-09
Generated
2026-11-09
AI Q&A
2026-11-09
EPSS Evaluated
N/A
NVD
CVE-2026-125205
EUVD
EUVD-2026-120294

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
FFmpeg FFmpeg From 0 (inc) to 9.0.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in FFmpeg through 9.0.2 involves an unbounded memory allocation flaw in the av1_frame_merge bitstream filter. Attackers exploit this by providing a crafted .obu file that never includes a temporal delimiter OBU. This causes the system to buffer unlimited OBU data per temporal unit, leading to memory exhaustion and denial of service.

Detection Guidance

Detecting this vulnerability requires monitoring for unusual memory usage patterns or processes handling .obu files with FFmpeg. Check for processes using FFmpeg with the av1_frame_merge filter or excessive memory consumption when processing AV1 OBU files. Use system monitoring tools like 'top', 'htop', or 'ps' to observe memory usage spikes.

Impact Analysis

The vulnerability can cause system crashes or slowdowns due to excessive memory consumption. If exploited, it may lead to denial of service, disrupting services that rely on FFmpeg for media processing. Users opening malicious .obu files could experience system instability.

Mitigation Strategies

Immediately update FFmpeg to the latest version that patches this vulnerability. If updating is not possible, disable the AV1 OBU and Annex B demuxers in FFmpeg configurations. Restrict access to FFmpeg for untrusted users and monitor for suspicious .obu file processing.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-125205. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...