UBUNTU-CVE-2026-125223: Medium severity ubuntu/ffmpeg vulnerability

Published Nov 10, 2026

Updated

FFmpeg 8.0 through 9.0.2 contains a memory leak vulnerability in the VP9 decoder that allows attackers to exhaust memory because vp9decodeframe() skips resetting the CBS fragment on error paths. Attackers can supply a crafted VP9 stream with invalid tile sizes decoded with slice threading to leak packet buffers and units, exhausting memory in the decoding application.

Affected Software

7 affected components

ubuntu/ffmpeg*

Event History

Nov 10, 2026

CVE Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are exposed to this issue?

Applications using the affected FFmpeg VP9 decoder are exposed when they decode attacker-supplied VP9 streams with slice threading enabled. The listed affected FFmpeg range is 8.0 through 9.0.2.

What must an attacker provide to trigger the memory leak?

An attacker needs to supply a crafted VP9 stream containing invalid tile sizes and have it decoded by the vulnerable VP9 decoder with slice threading. Successful triggering leaks packet buffers and units, which can exhaust memory in the decoding application.

What is the expected impact if exploitation succeeds?

The issue can exhaust memory in the application performing VP9 decoding, resulting in an availability impact. The provided vector indicates no confidentiality or integrity impact.

UBUNTU-CVE-2026-125223: Medium severity ubuntu/ffmpeg vulnerability

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What must an attacker provide to trigger the memory leak?

What is the expected impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What must an attacker provide to trigger the memory leak?

What is the expected impact if exploitation succeeds?