CVE-2026-125104: FFmpeg through 9.0.2 Memory Exhaustion DoS via APE Decoder apedec.c

Q: What input is required to trigger the issue?

An attacker must provide a crafted legacy Monkey's Audio (APE) file whose nblocks value declares an enormous number of blocks. Exploitation also requires a user or application to cause FFmpeg to decode that file.

Q: What is the practical impact on an affected system?

The crafted file can force gigabyte-scale memory allocations during APE frame decoding. This can exhaust available memory and cause a denial of service.

Q: Are systems that do not process APE media exposed?

The issue is in FFmpeg's APE decoder, so exposure depends on whether the deployment decodes attacker-controlled legacy Monkey's Audio files. The provided information does not establish impact for other media formats.

Published Nov 9, 2026

Updated

FFmpeg through 9.0.2 contains a memory exhaustion vulnerability in apedecodeframe() in libavcodec/apedec.c that fails to enforce the 73728-sample limit for legacy APE frames. Attackers can supply a crafted legacy Monkey's Audio file declaring an enormous nblocks value to force gigabyte-scale allocations and cause denial of service.

Affected Software

1 affected component

FFmpeg FFmpeg<=9.0.2

Event History

Nov 9, 2026

CVE Published

via MITRE·07:10 PM

Data Sourced

via MITRE·07:10 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What input is required to trigger the issue?

An attacker must provide a crafted legacy Monkey's Audio (APE) file whose nblocks value declares an enormous number of blocks. Exploitation also requires a user or application to cause FFmpeg to decode that file.

What is the practical impact on an affected system?

The crafted file can force gigabyte-scale memory allocations during APE frame decoding. This can exhaust available memory and cause a denial of service.

Are systems that do not process APE media exposed?

The issue is in FFmpeg's APE decoder, so exposure depends on whether the deployment decodes attacker-controlled legacy Monkey's Audio files. The provided information does not establish impact for other media formats.

CVE-2026-125104: FFmpeg through 9.0.2 Memory Exhaustion DoS via APE Decoder apedec.c

Affected Software

Event History

Frequently Asked Questions

What input is required to trigger the issue?

What is the practical impact on an affected system?

Are systems that do not process APE media exposed?

Company

Resources

Contact

Frequently Asked Questions

What input is required to trigger the issue?

What is the practical impact on an affected system?

Are systems that do not process APE media exposed?