UBUNTU-CVE-2026-125207: Medium severity ubuntu/ffmpeg vulnerability
FFmpeg through 9.0.2 contains an uncontrolled memory allocation vulnerability in the Interplay ACM decoder that allows attackers to exhaust memory via an attacker-controlled block size. Attackers can supply a crafted ACM file with maximum level and row count in extradata, making decodeinit() allocate nearly a gigabyte and deny service.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems that use FFmpeg to process attacker-supplied Interplay ACM files are exposed to memory-exhaustion denial of service. The issue is in the Interplay ACM decoder and affects FFmpeg through 9.0.2.
What does an attacker need to exploit it?
An attacker needs to provide a crafted ACM file for decoding. The file uses maximum level and row-count values in extradata to trigger a nearly gigabyte-sized allocation during decoder initialization.
Is user interaction required?
Yes. The supplied vector indicates user interaction is required, meaning a user or application must cause the crafted ACM file to be processed.