UBUNTU-CVE-2026-125199: Medium severity ubuntu/ffmpeg vulnerability
FFmpeg through 9.0.2 contains a memory leak vulnerability in vc1decodeframe() in libavcodec/vc1dec.c that leaks slice buffers when initgetbits8() fails. Attackers can supply crafted files with repeated oversized VC-1 slices exceeding the bit reader limit to exhaust memory of decoding applications.
Affected Software
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications that decode attacker-controlled VC-1 media using FFmpeg are exposed, particularly where an attacker can cause repeated decoding of crafted files. The impact is memory exhaustion in the decoding application.
What does exploitation require?
An attacker must provide a crafted VC-1 file containing repeated oversized slices that exceed the bit reader limit. User interaction is required to have the vulnerable application process the file.
Are confidentiality or integrity affected?
The available severity data indicates no confidentiality or integrity impact. The stated impact is availability loss through exhaustion of application memory.