UBUNTU-CVE-2026-125236: Medium severity ubuntu/ffmpeg vulnerability
FFmpeg through 9.0.2 contains a memory leak vulnerability in allocframe() in libavcodec/vvc/refs.c that leaks SPS and PPS references when frame buffer allocation fails. Attackers can supply a crafted VVC (H.266) stream that repeatedly replaces parameter sets, steadily growing memory use and causing denial of service.
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Systems that use the Ubuntu FFmpeg package to process attacker-controlled VVC (H.266) streams are exposed. The practical impact is memory growth leading to denial of service.
What does an attacker need to do to trigger the leak?
An attacker needs to supply a crafted VVC stream that repeatedly replaces SPS and PPS parameter sets while frame buffer allocation fails. User interaction is required according to the supplied severity vector.
What can be done if an update cannot be applied immediately?
Avoid processing untrusted VVC streams, particularly inputs that can repeatedly replace parameter sets. Monitor FFmpeg-processing workloads for sustained memory growth and constrain their available memory to limit denial-of-service impact.
How can I tell whether a workload may be affected?
Review whether the workload uses Ubuntu's FFmpeg package and accepts or decodes VVC (H.266) content. Affected processing may show steadily increasing memory use when handling crafted VVC input.