CVE-2026-125198

Description

FFmpeg through 9.0.2 contains a memory leak vulnerability in mediaformat_jni_setBuffer() in libavcodec/mediacodec_wrapper.c that never frees buffers wrapped with NewDirectByteBuffer(). Attackers can supply crafted media files with large extradata, leaking native memory on each MediaCodec decoder configuration in Android applications and causing resource exhaustion.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

References

• https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22550 ↗
• https://github.com/FFmpeg/FFmpeg/commit/e5d295b3cd467fc713300e208ba2dacc7ff603a0 ↗
• https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/mediacodec_wrapper.c#L1134 ↗
• https://github.com/FFmpeg/FFmpeg ↗
• https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-memory-leak-via-mediacodec-jni-setbuffer ↗