CVE-2026-125173: FFmpeg through 9.0.2 Memory Leak in libxevd EVC Decoder Wrapper

Q: What must an attacker be able to do to exploit this issue?

They must be able to provide a crafted EVC stream to an application that decodes it with the affected libxevd decoder wrapper. The stream contains many access units with only parameter sets or other non-frame NAL units.

Q: What is the practical impact on an affected application?

Each qualifying access unit can leak the pkt_au allocation because no picture is produced. Repeated input can exhaust the decoding application's memory and cause a denial of service.

Q: Are applications affected if they do not decode attacker-controlled EVC content?

The described attack requires crafted EVC input to be supplied to the decoder. Applications that do not use the libxevd EVC decoder for untrusted or attacker-provided streams are not exposed through this attack path.

Q: How can I identify potentially affected deployments?

Check whether the deployment uses FFmpeg through 9.0.2 and invokes the libxevd EVC decoder wrapper. During testing, crafted EVC streams with parameter-set-only or other non-frame access units may cause memory usage to grow over time.

Published Nov 9, 2026

Updated

FFmpeg through 9.0.2 contains a memory leak vulnerability in libxevdreceiveframe() in libavcodec/libxevd.c that fails to free pktau when an access unit produces no picture. Attackers can supply a crafted EVC stream with many access units containing only parameter sets or non-frame NAL units to exhaust memory in the decoding application.

Affected Software

1 affected component

FFmpeg FFmpeg<=9.0.2

Event History

Nov 9, 2026

CVE Published

via MITRE·07:11 PM

Data Sourced

via MITRE·07:11 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What must an attacker be able to do to exploit this issue?

They must be able to provide a crafted EVC stream to an application that decodes it with the affected libxevd decoder wrapper. The stream contains many access units with only parameter sets or other non-frame NAL units.

What is the practical impact on an affected application?

Each qualifying access unit can leak the pkt_au allocation because no picture is produced. Repeated input can exhaust the decoding application's memory and cause a denial of service.

Are applications affected if they do not decode attacker-controlled EVC content?

The described attack requires crafted EVC input to be supplied to the decoder. Applications that do not use the libxevd EVC decoder for untrusted or attacker-provided streams are not exposed through this attack path.

How can I identify potentially affected deployments?

Check whether the deployment uses FFmpeg through 9.0.2 and invokes the libxevd EVC decoder wrapper. During testing, crafted EVC streams with parameter-set-only or other non-frame access units may cause memory usage to grow over time.

CVE-2026-125173: FFmpeg through 9.0.2 Memory Leak in libxevd EVC Decoder Wrapper

Affected Software

Event History

Frequently Asked Questions

What must an attacker be able to do to exploit this issue?

What is the practical impact on an affected application?

Are applications affected if they do not decode attacker-controlled EVC content?

How can I identify potentially affected deployments?

Company

Resources

Contact

Frequently Asked Questions

What must an attacker be able to do to exploit this issue?

What is the practical impact on an affected application?

Are applications affected if they do not decode attacker-controlled EVC content?

How can I identify potentially affected deployments?