CVE-2026-125207
Received Received - Intake

Memory Exhaustion in FFmpeg Interplay ACM Decoder

Publication date: 2026-11-09

Last updated on: 2026-11-09

Assigner: VulnCheck

Description
FFmpeg through 9.0.2 contains an uncontrolled memory allocation vulnerability in the Interplay ACM decoder that allows attackers to exhaust memory via an attacker-controlled block size. Attackers can supply a crafted ACM file with maximum level and row count in extradata, making decode_init() allocate nearly a gigabyte and deny service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-09
Last Modified
2026-11-09
Generated
2026-11-09
AI Q&A
2026-11-09
EPSS Evaluated
N/A
NVD
CVE-2026-125207
EUVD
EUVD-2026-120296

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
FFmpeg FFmpeg From 0 (inc) to 9.0.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-789 The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

FFmpeg through version 9.0.2 has an uncontrolled memory allocation flaw in the Interplay ACM decoder. Attackers can exploit this by providing a specially crafted ACM file with maximum level and row count in extradata. This causes decode_init() to allocate nearly 1 GB of memory, leading to a denial of service.

Detection Guidance

Detecting this vulnerability requires checking for FFmpeg versions through 9.0.2 and analyzing files processed by the Interplay ACM decoder. Inspect FFmpeg installations using 'ffmpeg -version' and monitor memory usage during file processing. Look for unusually high memory consumption when decoding ACM files.

Impact Analysis

This vulnerability can cause system crashes or slowdowns due to excessive memory consumption. If exploited, it may disrupt services relying on FFmpeg for media processing, such as video playback or streaming applications.

Mitigation Strategies

Immediately update FFmpeg to a version beyond 9.0.2. If updating is not possible, disable the Interplay ACM decoder by removing or renaming the relevant library files. Restrict access to systems that process media files and monitor for suspicious file uploads.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-125207. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...