Memory Leak in FFmpeg's VVC Decoder Affecting Multiple Versions
CVE-2026-125236

4.8MEDIUM

Key Information:

Vendor

Ffmpeg

Status
Ffmpeg
Vendor
CVE Published:
9 November 2026

What is CVE-2026-125236?

A memory leak vulnerability exists in the VVC decoder of FFmpeg prior to version 9.0.2. This vulnerability arises in the alloc_frame() function within the libavcodec module, specifically when frame buffer allocation fails. Attackers can exploit this vulnerability by sending crafted VVC (H.266) streams that continuously replace parameter sets, leading to increased memory consumption over time. This gradual memory accumulation can result in a denial of service condition, impacting the stability and availability of affected FFmpeg installations.

Affected Version(s)

FFmpeg 0 <= 9.0.2

References

https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25088
issue-tracking
https://github.com/FFmpeg/FFmpeg/commit/a13e27336a61a3452...
patch
https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/v...
technical-description

CVSS V4

Score:
4.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Joshua Rogers (AISLE Research)
Michael Niedermayer
.