CVE-2026-125198

FFmpeg through 9.0.2 contains a memory leak vulnerability in mediaformat jni setBuffer() in libavcodec/mediacodec wrapper.c that never frees buffers wrapped with NewDirectByteBuffer(). Attackers can supply crafted media files with large extradata, leaking native memory on each MediaCodec decoder configuration in Android applications and causing resource exhaustion.