CVE-2026-125200: FFmpeg through 9.0.2 Memory Leak via libx265 Dolby Vision RPU Payloads

Q: Which workflows are exposed to this issue?

Workflows that transcode attacker-supplied Dolby Vision HEVC or AV1 media using FFmpeg's libx265 encoder are exposed. The leak occurs once per encoded frame, so longer inputs can drive continued memory growth.

Q: What must an attacker do to trigger the denial of service?

An attacker must provide a crafted Dolby Vision HEVC or AV1 file and have it processed through libx265 transcoding. The issue is local attack vector with no privileges required, but user interaction is required according to the supplied severity vector.

Q: How can operators recognize an attempted or successful trigger?

Monitor FFmpeg/libx265 transcoding jobs handling Dolby Vision HEVC or AV1 input for memory usage that increases continuously with each encoded frame. Affected jobs may eventually exhaust available memory and cause denial of service.

Published Nov 9, 2026

Updated

FFmpeg through 9.0.2 contains a memory leak vulnerability in libavcodec/libx265.c because libx265encodeframe() never frees the rpu.payload allocated by ffdovirpugenerate(). Attackers can supply crafted Dolby Vision HEVC or AV1 files that leak one RPU allocation per encoded frame during libx265 transcoding, causing unbounded memory growth and denial of service.

Affected Software

1 affected component

FFmpeg FFmpeg<=9.0.2

Event History

Nov 9, 2026

CVE Published

via MITRE·07:11 PM

Data Sourced

via MITRE·07:11 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which workflows are exposed to this issue?

Workflows that transcode attacker-supplied Dolby Vision HEVC or AV1 media using FFmpeg's libx265 encoder are exposed. The leak occurs once per encoded frame, so longer inputs can drive continued memory growth.

What must an attacker do to trigger the denial of service?

An attacker must provide a crafted Dolby Vision HEVC or AV1 file and have it processed through libx265 transcoding. The issue is local attack vector with no privileges required, but user interaction is required according to the supplied severity vector.

How can operators recognize an attempted or successful trigger?

Monitor FFmpeg/libx265 transcoding jobs handling Dolby Vision HEVC or AV1 input for memory usage that increases continuously with each encoded frame. Affected jobs may eventually exhaust available memory and cause denial of service.

CVE-2026-125200: FFmpeg through 9.0.2 Memory Leak via libx265 Dolby Vision RPU Payloads

Affected Software

Event History

Frequently Asked Questions

Which workflows are exposed to this issue?

What must an attacker do to trigger the denial of service?

How can operators recognize an attempted or successful trigger?

Company

Resources

Contact

Frequently Asked Questions

Which workflows are exposed to this issue?

What must an attacker do to trigger the denial of service?

How can operators recognize an attempted or successful trigger?