CVE-2026-125198: FFmpeg through 9.0.2 Memory Leak via MediaCodec JNI setBuffer

Q: Which deployments are exposed to this issue?

The issue affects Android applications that use FFmpeg's MediaCodec decoder integration. Applications that do not configure MediaCodec decoders are not indicated as affected by the provided information.

Q: What must an attacker provide to trigger the leak?

An attacker must be able to supply a crafted media file with large extradata and have it processed through MediaCodec decoder configuration. Each such configuration can leak native memory.

Q: What is the likely operational impact?

Repeated processing of crafted files can consume native memory and cause resource exhaustion. The provided data does not indicate confidentiality or integrity impact.

Q: What can be done if updating is not immediately possible?

Limit or avoid processing untrusted media files through the affected MediaCodec decoder path, particularly files with unusually large extradata. Monitoring native-memory growth during MediaCodec decoder setup may help identify exploitation attempts.

Published Nov 9, 2026

Updated

FFmpeg through 9.0.2 contains a memory leak vulnerability in mediaformatjnisetBuffer() in libavcodec/mediacodecwrapper.c that never frees buffers wrapped with NewDirectByteBuffer(). Attackers can supply crafted media files with large extradata, leaking native memory on each MediaCodec decoder configuration in Android applications and causing resource exhaustion.

Affected Software

1 affected component

FFmpeg FFmpeg<=9.0.2

Event History

Nov 9, 2026

CVE Published

via MITRE·07:11 PM

Data Sourced

via MITRE·07:11 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

The issue affects Android applications that use FFmpeg's MediaCodec decoder integration. Applications that do not configure MediaCodec decoders are not indicated as affected by the provided information.

What must an attacker provide to trigger the leak?

An attacker must be able to supply a crafted media file with large extradata and have it processed through MediaCodec decoder configuration. Each such configuration can leak native memory.

What is the likely operational impact?

Repeated processing of crafted files can consume native memory and cause resource exhaustion. The provided data does not indicate confidentiality or integrity impact.

What can be done if updating is not immediately possible?

Limit or avoid processing untrusted media files through the affected MediaCodec decoder path, particularly files with unusually large extradata. Monitoring native-memory growth during MediaCodec decoder setup may help identify exploitation attempts.

CVE-2026-125198: FFmpeg through 9.0.2 Memory Leak via MediaCodec JNI setBuffer

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What must an attacker provide to trigger the leak?

What is the likely operational impact?

What can be done if updating is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What must an attacker provide to trigger the leak?

What is the likely operational impact?

What can be done if updating is not immediately possible?