CVE-2026-125207: FFmpeg through 9.0.2 Excessive Memory Allocation via Interplay ACM Decoder

Q: What must an attacker provide to trigger the memory exhaustion?

The attacker must supply a crafted Interplay ACM file. The file uses maximum level and row-count values in its extradata so that decoder initialization calculates an attacker-controlled block size and allocates nearly 1 GB of memory.

Q: Does exploitation require authentication or user interaction?

The supplied vector indicates no privileges are required, but user interaction is required. Exploitation is local, so the vulnerable decoder must process the attacker-controlled ACM file in the local context.

Q: What is the expected impact of successful exploitation?

The documented impact is denial of service through memory exhaustion. The provided vector indicates no confidentiality or integrity impact.

Published Nov 9, 2026

Updated

FFmpeg through 9.0.2 contains an uncontrolled memory allocation vulnerability in the Interplay ACM decoder that allows attackers to exhaust memory via an attacker-controlled block size. Attackers can supply a crafted ACM file with maximum level and row count in extradata, making decodeinit() allocate nearly a gigabyte and deny service.

Affected Software

1 affected component

FFmpeg FFmpeg<=9.0.2

Event History

Nov 9, 2026

CVE Published

via MITRE·07:11 PM

Data Sourced

via MITRE·07:11 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What must an attacker provide to trigger the memory exhaustion?

The attacker must supply a crafted Interplay ACM file. The file uses maximum level and row-count values in its extradata so that decoder initialization calculates an attacker-controlled block size and allocates nearly 1 GB of memory.

Does exploitation require authentication or user interaction?

The supplied vector indicates no privileges are required, but user interaction is required. Exploitation is local, so the vulnerable decoder must process the attacker-controlled ACM file in the local context.

What is the expected impact of successful exploitation?

The documented impact is denial of service through memory exhaustion. The provided vector indicates no confidentiality or integrity impact.

CVE-2026-125207: FFmpeg through 9.0.2 Excessive Memory Allocation via Interplay ACM Decoder

Affected Software

Event History

Frequently Asked Questions

What must an attacker provide to trigger the memory exhaustion?

Does exploitation require authentication or user interaction?

What is the expected impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

What must an attacker provide to trigger the memory exhaustion?

Does exploitation require authentication or user interaction?

What is the expected impact of successful exploitation?