PT-2026-141026
CVE-2026-125198
·
Published
2026-11-09
·
Updated
2026-11-09
Description by
CVSS 3.1
2.5
LowMetricsAV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
FFmpeg through 9.0.2 contains a memory leak vulnerability in mediaformat jni setBuffer() in libavcodec/mediacodec wrapper.c that never frees buffers wrapped with NewDirectByteBuffer(). Attackers can supply crafted media files with large extradata, leaking native memory on each MediaCodec decoder configuration in Android applications and causing resource exhaustion.
Found an issue in the description? Have something to add? Feel free to write us 👾