UBUNTU-CVE-2026-125104: Medium severity ubuntu/ffmpeg vulnerability

Published Nov 10, 2026

Updated

FFmpeg through 9.0.2 contains a memory exhaustion vulnerability in apedecodeframe() in libavcodec/apedec.c that fails to enforce the 73728-sample limit for legacy APE frames. Attackers can supply a crafted legacy Monkey's Audio file declaring an enormous nblocks value to force gigabyte-scale allocations and cause denial of service.

Affected Software

7 affected components

ubuntu/ffmpeg*

Event History

Nov 10, 2026

CVE Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who is exposed to this issue?

Systems that use the affected FFmpeg APE decoder to process legacy Monkey's Audio files are exposed. Exploitation requires the system to handle a crafted file; the attack vector is local and user interaction is required.

What does an attacker need to trigger the denial of service?

An attacker needs to provide a crafted legacy Monkey's Audio file with an enormous nblocks value. When FFmpeg decodes the file, ape_decode_frame() can make gigabyte-scale allocations and exhaust memory.

What is the impact of successful exploitation?

Successful exploitation can exhaust available memory and cause a denial of service. The provided scoring indicates no direct impact on confidentiality or integrity.

How can I tell whether my FFmpeg installation is affected?

The issue affects FFmpeg through version 9.0.2. Check the version of the FFmpeg package installed on Ubuntu and whether it is used to decode legacy APE files.

UBUNTU-CVE-2026-125104: Medium severity ubuntu/ffmpeg vulnerability

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to trigger the denial of service?

What is the impact of successful exploitation?

How can I tell whether my FFmpeg installation is affected?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to trigger the denial of service?

What is the impact of successful exploitation?

How can I tell whether my FFmpeg installation is affected?