PT-2026-141028
CVE-2026-125200
·
Published
2026-11-09
·
Updated
2026-11-09
Description by
CVSS 3.1
5.5
MediumMetricsAV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
FFmpeg through 9.0.2 contains a memory leak vulnerability in libavcodec/libx265.c because libx265 encode frame() never frees the rpu.payload allocated by ff dovi rpu generate(). Attackers can supply crafted Dolby Vision HEVC or AV1 files that leak one RPU allocation per encoded frame during libx265 transcoding, causing unbounded memory growth and denial of service.
Found an issue in the description? Have something to add? Feel free to write us 👾