CVE-2026-125200

Description

FFmpeg through 9.0.2 contains a memory leak vulnerability in libavcodec/libx265.c because libx265_encode_frame() never frees the rpu.payload allocated by ff_dovi_rpu_generate(). Attackers can supply crafted Dolby Vision HEVC or AV1 files that leak one RPU allocation per encoded frame during libx265 transcoding, causing unbounded memory growth and denial of service.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

References

• https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25416 ↗
• https://github.com/FFmpeg/FFmpeg/commit/8dc4af2bbbd0d650e299a3d327bd48c775120e11 ↗
• https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/libx265.c#L880 ↗
• https://github.com/FFmpeg/FFmpeg ↗
• https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-memory-leak-via-libx265-dolby-vision-rpu-payloads ↗