CVE-2026-125223
Received Received - Intake

Memory Leak in FFmpeg VP9 Decoder

Publication date: 2026-11-09

Last updated on: 2026-11-09

Assigner: VulnCheck

Description
FFmpeg 8.0 through 9.0.2 contains a memory leak vulnerability in the VP9 decoder that allows attackers to exhaust memory because vp9_decode_frame() skips resetting the CBS fragment on error paths. Attackers can supply a crafted VP9 stream with invalid tile sizes decoded with slice threading to leak packet buffers and units, exhausting memory in the decoding application.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-09
Last Modified
2026-11-09
Generated
2026-11-09
AI Q&A
2026-11-09
EPSS Evaluated
N/A
NVD
CVE-2026-125223
EUVD
EUVD-2026-120312

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
FFmpeg FFmpeg From 8.0 (inc) to 9.0.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-401 The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

FFmpeg versions 8.0 through 9.0.2 have a memory leak in the VP9 decoder. When processing a crafted VP9 video stream with invalid tile sizes using slice threading, the decoder fails to reset certain data structures on error paths. This causes memory buffers to leak, allowing attackers to exhaust system memory in the affected application.

Impact Analysis

This vulnerability can cause denial-of-service conditions by consuming all available memory on a system running vulnerable FFmpeg versions. It may crash applications, slow down systems, or require manual intervention to restore normal operation.

Mitigation Strategies

Update FFmpeg to a version later than 9.0.2 to address the memory leak in the VP9 decoder. Avoid processing untrusted VP9 streams with invalid tile sizes, especially with slice threading enabled.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-125223. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...