Double Free Vulnerability in FFmpeg Affects Multiple Versions
CVE-2026-125269

7.3HIGH

Key Information:

Vendor

Ffmpeg

Status
Ffmpeg
Vendor
CVE Published:
9 November 2026

What is CVE-2026-125269?

FFmpeg versions up to 9.0.2 contain a double free vulnerability in the libavcodec component, specifically in cbs_sei.c. This issue arises when the function cbs_sei_delete_message() fails to properly manage the extension_data reference, which can then be misused by ff_cbs_sei_add_message(). An attacker could exploit this vulnerability by delivering a specially crafted H.264 stream, including a display orientation SEI message followed by crafted payload extension data. The vulnerability allows manipulation of heap memory, potentially enabling a range of malicious activities.

Affected Version(s)

FFmpeg 0 <= 9.0.2

References

https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25020
issue-tracking
https://github.com/FFmpeg/FFmpeg/commit/2c515eea07df71937...
patch
https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/c...
technical-description

CVSS V4

Score:
7.3
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Claude and Ada Logics
Joshua Rogers (AISLE Research)
Michael Niedermayer
.