CVE-2026-125223: FFmpeg 8.0 through 9.0.2 Memory Leak in VP9 Decoder via vp9_decode_frame

Q: What conditions are required for exploitation?

An attacker must provide a crafted VP9 stream containing invalid tile sizes to an application that decodes it with slice threading enabled. Successful exploitation exhausts memory in the decoding application.

Q: What is the operational impact of a successful attack?

The error path in vp9_decode_frame() does not reset the CBS fragment, allowing packet buffers and units to leak. Repeated processing of malicious input can consume available memory and cause a denial of service.

Q: Which FFmpeg versions are identified as affected?

The affected range is FFmpeg 8.0 through 9.0.2.

Published Nov 9, 2026

Updated

FFmpeg 8.0 through 9.0.2 contains a memory leak vulnerability in the VP9 decoder that allows attackers to exhaust memory because vp9decodeframe() skips resetting the CBS fragment on error paths. Attackers can supply a crafted VP9 stream with invalid tile sizes decoded with slice threading to leak packet buffers and units, exhausting memory in the decoding application.

Affected Software

1 affected component

FFmpeg FFmpeg>=8.0<=9.0.2

Event History

Nov 9, 2026

CVE Published

via MITRE·07:11 PM

Data Sourced

via MITRE·07:11 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What conditions are required for exploitation?

An attacker must provide a crafted VP9 stream containing invalid tile sizes to an application that decodes it with slice threading enabled. Successful exploitation exhausts memory in the decoding application.

What is the operational impact of a successful attack?

The error path in vp9_decode_frame() does not reset the CBS fragment, allowing packet buffers and units to leak. Repeated processing of malicious input can consume available memory and cause a denial of service.

Which FFmpeg versions are identified as affected?

The affected range is FFmpeg 8.0 through 9.0.2.

CVE-2026-125223: FFmpeg 8.0 through 9.0.2 Memory Leak in VP9 Decoder via vp9_decode_frame

Affected Software

Event History

Frequently Asked Questions

What conditions are required for exploitation?

What is the operational impact of a successful attack?

Which FFmpeg versions are identified as affected?

Company

Resources

Contact

Frequently Asked Questions

What conditions are required for exploitation?

What is the operational impact of a successful attack?

Which FFmpeg versions are identified as affected?