CVE-2026-125226: FFmpeg through 9.0.2 Excessive Memory Allocation via SBaGen Demuxer

Q: Who is exposed to this issue?

Systems that process attacker-supplied SBaGen scripts with FFmpeg through 9.0.2 are exposed. Exploitation requires a user or workflow to open or otherwise process a crafted script, so it is most relevant where untrusted media inputs are accepted.

Q: What does an attacker need to do to trigger the denial of service?

The attacker must provide a crafted SBaGen script that declares a very high -r sample rate. When FFmpeg reads the script header, the wavesynth decoder can derive an unbounded default frame size and allocate enough memory to exhaust the process or host.

Q: Is authentication or elevated privilege required?

No privileges are required by the vulnerability itself. The attacker needs local access and user interaction, as reflected by the AV:L and UI:R vector, meaning a user or local processing workflow must handle the malicious script.

Q: How can I determine whether a system is affected?

Check whether the deployed FFmpeg version is 9.0.2 or earlier and whether it processes SBaGen scripts. Review workflows that accept or automatically ingest untrusted SBaGen input, especially scripts that can specify the -r sample-rate option.

Published Nov 9, 2026

Updated

FFmpeg through 9.0.2 contains an uncontrolled memory allocation vulnerability in sbgreadheader() in libavformat/sbgdec.c that derives an unbounded default frame size from the script's sample rate. Attackers can supply a crafted SBaGen script declaring a very high -r sample rate so the wavesynth decoder allocates enormous audio frames, exhausting memory and causing denial of service.

Affected Software

1 affected component

FFmpeg FFmpeg<=9.0.2

Event History

Nov 9, 2026

CVE Published

via MITRE·07:11 PM

Data Sourced

via MITRE·07:11 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Systems that process attacker-supplied SBaGen scripts with FFmpeg through 9.0.2 are exposed. Exploitation requires a user or workflow to open or otherwise process a crafted script, so it is most relevant where untrusted media inputs are accepted.

What does an attacker need to do to trigger the denial of service?

The attacker must provide a crafted SBaGen script that declares a very high -r sample rate. When FFmpeg reads the script header, the wavesynth decoder can derive an unbounded default frame size and allocate enough memory to exhaust the process or host.

Is authentication or elevated privilege required?

No privileges are required by the vulnerability itself. The attacker needs local access and user interaction, as reflected by the AV:L and UI:R vector, meaning a user or local processing workflow must handle the malicious script.

How can I determine whether a system is affected?

Check whether the deployed FFmpeg version is 9.0.2 or earlier and whether it processes SBaGen scripts. Review workflows that accept or automatically ingest untrusted SBaGen input, especially scripts that can specify the -r sample-rate option.

CVE-2026-125226: FFmpeg through 9.0.2 Excessive Memory Allocation via SBaGen Demuxer

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to do to trigger the denial of service?

Is authentication or elevated privilege required?

How can I determine whether a system is affected?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to do to trigger the denial of service?

Is authentication or elevated privilege required?

How can I determine whether a system is affected?