Resource Leak in FFmpeg JPEG XS Decoder Affects Multiple Versions

CVE-2026-125240

What is CVE-2026-125240?

FFmpeg versions up to 9.0.2 are affected by a resource leak vulnerability in the JPEG XS decoder, specifically within the svt_jpegxs_dec_decode function. This vulnerability allows attackers to supply maliciously crafted JPEG XS streams, particularly within MPEG-TS, containing oversized headers that can trigger repeated leaks of decoder threads and buffers. As a result, this can lead to memory exhaustion, potentially rendering applications vulnerable to denial-of-service conditions.

References