CVE-2026-125223

Description

FFmpeg 8.0 through 9.0.2 contains a memory leak vulnerability in the VP9 decoder that allows attackers to exhaust memory because vp9_decode_frame() skips resetting the CBS fragment on error paths. Attackers can supply a crafted VP9 stream with invalid tile sizes decoded with slice threading to leak packet buffers and units, exhausting memory in the decoding application.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

References

• https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25232 ↗
• https://github.com/FFmpeg/FFmpeg/commit/bcce3232016695f5e482867519c45727a0a2a2c9 ↗
• https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/vp9.c#L1766 ↗
• https://github.com/FFmpeg/FFmpeg ↗
• https://www.vulncheck.com/advisories/ffmpeg-8.0-through-9.0.2-memory-leak-in-vp9-decoder-via-vp9-decode-frame ↗