CVE-2026-125240: FFmpeg through 9.0.2 Resource Leak in libsvtjpegxs JPEG XS Decoder Wrapper

Q: What access and interaction does exploitation require according to the supplied CVSS vector?

The vector indicates local attack access, no privileges required, and user interaction required. The stated impact is limited to availability.

Q: Which processing path should be prioritized when assessing exposure?

Prioritize FFmpeg deployments that decode JPEG XS streams through the libsvtjpegxs decoder wrapper, especially where streams may contain attacker-controlled frame headers. The leak is triggered when ff_set_dimensions() rejects the supplied dimensions.

Q: Is an upstream remediation reference available?

The supplied references include FFmpeg commit 3aa561b0dd2054182fbb9548b4526e8500d52a52 and pull request 25416. The data does not identify a release version containing that change.

Published Nov 9, 2026

Updated

FFmpeg through 9.0.2 contains a resource leak vulnerability in svtjpegxsdecdecode() in libsvtjpegxsdec.c that leaks decoder instances when ffsetdimensions() rejects frame dimensions. Attackers can supply a crafted JPEG XS stream, for example in MPEG-TS, with oversized headers to repeatedly leak decoder threads and buffers, exhausting memory.

Affected Software

1 affected component

FFmpeg FFmpeg<=9.0.2

Event History

Nov 9, 2026

CVE Published

via MITRE·07:11 PM

Data Sourced

via MITRE·07:11 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What access and interaction does exploitation require according to the supplied CVSS vector?

The vector indicates local attack access, no privileges required, and user interaction required. The stated impact is limited to availability.

Which processing path should be prioritized when assessing exposure?

Prioritize FFmpeg deployments that decode JPEG XS streams through the libsvtjpegxs decoder wrapper, especially where streams may contain attacker-controlled frame headers. The leak is triggered when ff_set_dimensions() rejects the supplied dimensions.

Is an upstream remediation reference available?

The supplied references include FFmpeg commit 3aa561b0dd2054182fbb9548b4526e8500d52a52 and pull request 25416. The data does not identify a release version containing that change.

CVE-2026-125240: FFmpeg through 9.0.2 Resource Leak in libsvtjpegxs JPEG XS Decoder Wrapper

Affected Software

Event History

Frequently Asked Questions

What access and interaction does exploitation require according to the supplied CVSS vector?

Which processing path should be prioritized when assessing exposure?

Is an upstream remediation reference available?

Company

Resources

Contact

Frequently Asked Questions

What access and interaction does exploitation require according to the supplied CVSS vector?

Which processing path should be prioritized when assessing exposure?

Is an upstream remediation reference available?