CVE-2026-125236: FFmpeg through 9.0.2 VVC Decoder Memory Leak via alloc_frame()

Q: Who is realistically exposed to this issue?

Systems that decode attacker-controlled VVC (H.266) streams with affected FFmpeg versions are exposed. The impact is denial of service through increasing memory consumption, rather than loss of confidentiality or integrity.

Q: What must an attacker do to trigger the leak?

An attacker must provide a crafted VVC stream that repeatedly replaces SPS and PPS parameter sets while causing frame buffer allocation to fail. Exploitation requires user interaction according to the supplied vector.

Q: How can I determine whether an instance may be affected?

Check whether the deployed FFmpeg version is 9.0.2 or earlier and whether it processes VVC input. The affected code is alloc_frame() in libavcodec/vvc/refs.c.

Published Nov 9, 2026

Updated

FFmpeg through 9.0.2 contains a memory leak vulnerability in allocframe() in libavcodec/vvc/refs.c that leaks SPS and PPS references when frame buffer allocation fails. Attackers can supply a crafted VVC (H.266) stream that repeatedly replaces parameter sets, steadily growing memory use and causing denial of service.

Affected Software

1 affected component

FFmpeg FFmpeg<=9.0.2

Event History

Nov 9, 2026

CVE Published

via MITRE·07:11 PM

Data Sourced

via MITRE·07:11 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is realistically exposed to this issue?

Systems that decode attacker-controlled VVC (H.266) streams with affected FFmpeg versions are exposed. The impact is denial of service through increasing memory consumption, rather than loss of confidentiality or integrity.

What must an attacker do to trigger the leak?

An attacker must provide a crafted VVC stream that repeatedly replaces SPS and PPS parameter sets while causing frame buffer allocation to fail. Exploitation requires user interaction according to the supplied vector.

How can I determine whether an instance may be affected?

Check whether the deployed FFmpeg version is 9.0.2 or earlier and whether it processes VVC input. The affected code is alloc_frame() in libavcodec/vvc/refs.c.

CVE-2026-125236: FFmpeg through 9.0.2 VVC Decoder Memory Leak via alloc_frame()

Affected Software

Event History

Frequently Asked Questions

Who is realistically exposed to this issue?

What must an attacker do to trigger the leak?

How can I determine whether an instance may be affected?

Company

Resources

Contact

Frequently Asked Questions

Who is realistically exposed to this issue?

What must an attacker do to trigger the leak?

How can I determine whether an instance may be affected?