CVE-2026-125205: FFmpeg through 9.0.2 Memory Exhaustion via av1_frame_merge Bitstream Filter

Q: Which deployments are exposed to this denial-of-service issue?

Deployments that process attacker-controlled AV1 .obu input through the AV1 OBU or Annex B demuxers and use the av1_frame_merge bitstream filter are exposed. The impact is memory exhaustion and resulting denial of service.

Q: What does an attacker need to provide to trigger the issue?

An attacker needs to induce processing of a crafted .obu file that never sends a temporal delimiter OBU. No privileges are required, but the supplied file must be opened or otherwise processed by the affected AV1 input path.

Q: How can I identify potentially affected processing paths?

Review FFmpeg workflows that accept AV1 .obu files, use the AV1 OBU or Annex B demuxers, and invoke the av1_frame_merge bitstream filter. The affected behavior is unbounded buffering of OBUs within a temporal unit when no temporal delimiter OBU is received.

Published Nov 9, 2026

Updated

FFmpeg through 9.0.2 contains an unbounded memory allocation vulnerability in the av1framemerge bitstream filter that allows attackers to exhaust memory by never sending a temporal delimiter OBU. Attackers can supply a crafted .obu file opened by the AV1 OBU or Annex B demuxers, forcing unlimited OBU buffering per temporal unit and causing denial of service.

Affected Software

1 affected component

FFmpeg FFmpeg<=9.0.2

Event History

Nov 9, 2026

CVE Published

via MITRE·07:11 PM

Data Sourced

via MITRE·07:11 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this denial-of-service issue?

Deployments that process attacker-controlled AV1 .obu input through the AV1 OBU or Annex B demuxers and use the av1_frame_merge bitstream filter are exposed. The impact is memory exhaustion and resulting denial of service.

What does an attacker need to provide to trigger the issue?

An attacker needs to induce processing of a crafted .obu file that never sends a temporal delimiter OBU. No privileges are required, but the supplied file must be opened or otherwise processed by the affected AV1 input path.

How can I identify potentially affected processing paths?

Review FFmpeg workflows that accept AV1 .obu files, use the AV1 OBU or Annex B demuxers, and invoke the av1_frame_merge bitstream filter. The affected behavior is unbounded buffering of OBUs within a temporal unit when no temporal delimiter OBU is received.

CVE-2026-125205: FFmpeg through 9.0.2 Memory Exhaustion via av1_frame_merge Bitstream Filter

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed to this denial-of-service issue?

What does an attacker need to provide to trigger the issue?

How can I identify potentially affected processing paths?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this denial-of-service issue?

What does an attacker need to provide to trigger the issue?

How can I identify potentially affected processing paths?