CVE-2026-125223

MediumCVSS 4.7/10Last modified Nov 10, 2026

Description

FFmpeg 8.0 through 9.0.2 contains a memory leak vulnerability in the VP9 decoder that allows attackers to exhaust memory because vp9_decode_frame() skips resetting the CBS fragment on error paths. Attackers can supply a crafted VP9 stream with invalid tile sizes decoded with slice threading to leak packet buffers and units, exhausting memory in the decoding application.

Metrics

CVSS 3.1 4.7/10CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-401

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Nov 9, 2026
Last modified: Nov 10, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-1252245.5FFmpeg through 9.0.2 contains a denial of service vulnerability in libavcodec/vorbis_parser.c that re-parses invalid extradata for every pac CVE-2026-1252255.5FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in aac_adtstoasc_filter() that allows attackers to crash applications CVE-2026-1252265.5FFmpeg through 9.0.2 contains an uncontrolled memory allocation vulnerability in sbg_read_header() in libavformat/sbgdec.c that derives an u CVE-2026-1252277.0FFmpeg through 9.0.2 contains an integer overflow in cbs_jpeg_write_scan() in libavcodec/cbs_jpeg.c that causes a heap buffer overflow on 32 CVE-2026-1252285.3FFmpeg before 8.1.3 and 9.x before 9.0.2 contains an out-of-bounds read vulnerability in put_vector() in libavcodec/vorbisenc.c when NaN sam CVE-2026-1252297.8FFmpeg through 9.0.2 contains an out-of-bounds memory access vulnerability in the encode_frame() function of libavcodec/huffyuvenc.c, becaus CVE-2026-125237.5Summary Cloudflare quiche's HTTP/3 layer was discovered to be vulnerable to resource exhaustion (i.e., memory) by means of specially craf CVE-2026-1252305.5FFmpeg through 9.0.2 contains an integer overflow vulnerability in the pcm_rechunk bitstream filter that allows attackers to trigger divisio CVE-2026-1252315.5FFmpeg 4.4 through 9.0.2 contains a NULL pointer dereference vulnerability in libavcodec/adxdec.c because adx_decode_header() updates the ch CVE-2026-1252325.5FFmpeg through 9.0.2 contains a division by zero vulnerability in estimate_motion_b() in libavcodec/motion_est.c, caused by frame timestamp CVE-2026-1252337.8FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in dvbsub_encode() in libavcodec/dvbsubenc.c that undercounts each CLUT s CVE-2026-1252345.5FFmpeg through 9.0.2 contains an integer overflow vulnerability in wavpack_encode_init() in libavcodec/wavpackenc.c that causes an infinite