UBUNTU-CVE-2026-125198: Low severity ubuntu/ffmpeg vulnerability
FFmpeg through 9.0.2 contains a memory leak vulnerability in mediaformatjnisetBuffer() in libavcodec/mediacodecwrapper.c that never frees buffers wrapped with NewDirectByteBuffer(). Attackers can supply crafted media files with large extradata, leaking native memory on each MediaCodec decoder configuration in Android applications and causing resource exhaustion.
Affected Software
Event History
Frequently Asked Questions
Which deployments are realistically exposed to this issue?
The affected code path is in FFmpeg's MediaCodec wrapper, so exposure is relevant to Android applications that use MediaCodec decoding through FFmpeg. The provided information does not establish exposure for other FFmpeg use cases.
What must an attacker do to trigger the resource exhaustion?
An attacker must supply a crafted media file with large extradata and induce MediaCodec decoder configuration. Exploitation requires local attack-vector conditions, high attack complexity, and user interaction according to the supplied severity vector.
What is the operational impact if exploitation succeeds?
Each affected decoder configuration leaks native memory because buffers wrapped with NewDirectByteBuffer() are not freed. Repeated triggering can exhaust resources and affect availability; no confidentiality or integrity impact is indicated.