CVE-2026-125224: FFmpeg through 9.0.2 Vorbis Parser CPU Exhaustion via Invalid Extradata

Q: Which FFmpeg deployments are most exposed?

Deployments that demux or probe untrusted Ogg or Matroska files containing Vorbis streams are exposed. The issue is triggered during handling of crafted media input rather than through a network service alone.

Q: What does an attacker need to do to trigger the CPU exhaustion?

An attacker needs to provide a crafted Ogg or Matroska Vorbis stream with large invalid extradata and many packets, and have it processed by FFmpeg. The supplied vector indicates no privileges are required, but user interaction is required.

Q: What versions are known to be affected?

FFmpeg through 9.0.2 is identified as affected. The provided data does not state the first fixed release.

Published Nov 9, 2026

Updated

FFmpeg through 9.0.2 contains a denial of service vulnerability in libavcodec/vorbisparser.c that re-parses invalid extradata for every packet when validextradata remains false. Attackers can supply crafted Ogg or Matroska Vorbis streams with large invalid extradata and many packets to exhaust CPU during demuxing or probing.

Affected Software

1 affected component

FFmpeg FFmpeg<=9.0.2

Event History

Nov 9, 2026

CVE Published

via MITRE·07:11 PM

Data Sourced

via MITRE·07:11 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which FFmpeg deployments are most exposed?

Deployments that demux or probe untrusted Ogg or Matroska files containing Vorbis streams are exposed. The issue is triggered during handling of crafted media input rather than through a network service alone.

What does an attacker need to do to trigger the CPU exhaustion?

An attacker needs to provide a crafted Ogg or Matroska Vorbis stream with large invalid extradata and many packets, and have it processed by FFmpeg. The supplied vector indicates no privileges are required, but user interaction is required.

What versions are known to be affected?

FFmpeg through 9.0.2 is identified as affected. The provided data does not state the first fixed release.

CVE-2026-125224: FFmpeg through 9.0.2 Vorbis Parser CPU Exhaustion via Invalid Extradata

Affected Software

Event History

Frequently Asked Questions

Which FFmpeg deployments are most exposed?

What does an attacker need to do to trigger the CPU exhaustion?

What versions are known to be affected?

Company

Resources

Contact

Frequently Asked Questions

Which FFmpeg deployments are most exposed?

What does an attacker need to do to trigger the CPU exhaustion?

What versions are known to be affected?