UBUNTU-CVE-2026-125205: Medium severity ubuntu/ffmpeg vulnerability
FFmpeg through 9.0.2 contains an unbounded memory allocation vulnerability in the av1framemerge bitstream filter that allows attackers to exhaust memory by never sending a temporal delimiter OBU. Attackers can supply a crafted .obu file opened by the AV1 OBU or Annex B demuxers, forcing unlimited OBU buffering per temporal unit and causing denial of service.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using FFmpeg to open attacker-supplied AV1 OBU or Annex B content are exposed. The crafted input is a .obu file processed through the AV1 OBU or Annex B demuxers and the av1_frame_merge bitstream filter.
What does an attacker need to exploit it?
An attacker needs to provide a crafted .obu file and have it opened by a vulnerable FFmpeg workflow. The attack relies on input that never includes a temporal delimiter OBU, causing unlimited buffering for a temporal unit.
What is the impact of successful exploitation?
Successful exploitation can exhaust memory and cause a denial of service. The provided severity data indicates availability impact, with no indicated confidentiality or integrity impact.