CVE-2026-125199: FFmpeg through 9.0.2 Memory Leak in VC-1 Decoder via vc1_decode_frame()

Q: Which deployments are exposed?

Applications that use affected FFmpeg versions to decode VC-1 content are exposed when they process attacker-supplied files. The impact is exhaustion of the decoding application's memory, which can cause denial of service.

Q: What must an attacker provide to trigger the issue?

The attacker must cause the application to decode a crafted VC-1 file containing repeated oversized slices that exceed the bit-reader limit. User interaction is required to have the crafted content processed.

Q: How can this be mitigated if an update is not immediately possible?

Avoid decoding untrusted VC-1 files, particularly files that may contain repeated oversized slices. Limit exposure of applications that automatically process user-supplied media.

Q: Which versions should be investigated?

The issue is reported to affect FFmpeg through version 9.0.2. The provided data does not identify a first fixed version.

Published Nov 9, 2026

Updated

FFmpeg through 9.0.2 contains a memory leak vulnerability in vc1decodeframe() in libavcodec/vc1dec.c that leaks slice buffers when initgetbits8() fails. Attackers can supply crafted files with repeated oversized VC-1 slices exceeding the bit reader limit to exhaust memory of decoding applications.

Affected Software

1 affected component

FFmpeg FFmpeg<=9.0.2

Event History

Nov 9, 2026

CVE Published

via MITRE·07:11 PM

Data Sourced

via MITRE·07:11 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed?

Applications that use affected FFmpeg versions to decode VC-1 content are exposed when they process attacker-supplied files. The impact is exhaustion of the decoding application's memory, which can cause denial of service.

What must an attacker provide to trigger the issue?

The attacker must cause the application to decode a crafted VC-1 file containing repeated oversized slices that exceed the bit-reader limit. User interaction is required to have the crafted content processed.

How can this be mitigated if an update is not immediately possible?

Avoid decoding untrusted VC-1 files, particularly files that may contain repeated oversized slices. Limit exposure of applications that automatically process user-supplied media.

Which versions should be investigated?

The issue is reported to affect FFmpeg through version 9.0.2. The provided data does not identify a first fixed version.

CVE-2026-125199: FFmpeg through 9.0.2 Memory Leak in VC-1 Decoder via vc1_decode_frame()

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed?

What must an attacker provide to trigger the issue?

How can this be mitigated if an update is not immediately possible?

Which versions should be investigated?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What must an attacker provide to trigger the issue?

How can this be mitigated if an update is not immediately possible?

Which versions should be investigated?