CVE-2026-125223

EUVD-2026-120312
FFmpeg 8.0 through 9.0.2 contains a memory leak vulnerability in the VP9 decoder that allows attackers to exhaust memory because vp9_decode_frame() skips resetting the CBS fragment on error paths. Attackers can supply a crafted VP9 stream with invalid tile sizes decoded with slice threading to leak packet buffers and units, exhausting memory in the decoding application.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
4.7 MEDIUM
LOCAL
HIGH
NONE
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).
VendorProductVersionSource
ffmpegffmpeg
8.0 ≤
𝑥
≤ 9.0.2
CNA
Common Weakness Enumeration
References
https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25232
https://github.com/FFmpeg/FFmpeg
https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/vp9.c#L1766
https://github.com/FFmpeg/FFmpeg/commit/bcce3232016695f5e482867519c45727a0a2a2c9
https://www.vulncheck.com/advisories/ffmpeg-8.0-through-9.0.2-memory-leak-in-vp9-decoder-via-vp9-decode-frame