CVE-2026-125269: FFmpeg through 9.0.2 Double Free via cbs_sei_delete_message in cbs_sei.c
FFmpeg through 9.0.2 contains a double free vulnerability in libavcodec/cbssei.c where cbsseideletemessage() leaves a stale extensiondata reference that ffcbsseiaddmessage() reuses. Attackers can supply a crafted H.264 stream with a display orientation SEI message followed by payload extension data, processed by h264metadata with displayorientation=insert, to corrupt heap memory.
Affected Software
Event History
Frequently Asked Questions
Which deployments should be assessed first?
Assess FFmpeg installations through version 9.0.2 that process H.264 streams with the h264_metadata workflow and display_orientation=insert enabled.
What conditions are required for exploitation?
An attacker must be able to supply a crafted H.264 stream containing a display orientation SEI message followed by payload extension data. The CVSS vector indicates local attack access, no required privileges, and required user interaction.