UBUNTU-CVE-2026-125269: Double Free
FFmpeg through 9.0.2 contains a double free vulnerability in libavcodec/cbssei.c where cbsseideletemessage() leaves a stale extensiondata reference that ffcbsseiaddmessage() reuses. Attackers can supply a crafted H.264 stream with a display orientation SEI message followed by payload extension data, processed by h264metadata with displayorientation=insert, to corrupt heap memory.
Affected Software
Event History
Frequently Asked Questions
What processing path must be reached for exploitation?
A crafted H.264 stream must contain a display orientation SEI message followed by payload extension data, and it must be processed by h264_metadata with display_orientation=insert.
Does an attacker need privileges or user interaction?
The CVSS vector indicates no privileges are required, but the attack is local and requires user interaction. It also indicates high attack complexity and additional attack requirements.
Which versions are identified as vulnerable?
FFmpeg through version 9.0.2 is identified as containing the vulnerability.