PT-2026-141051
CVE-2026-125223
·
Published
2026-11-09
·
Updated
2026-11-09
Description by
CVSS 3.1
4.7
MediumMetricsAV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
FFmpeg 8.0 through 9.0.2 contains a memory leak vulnerability in the VP9 decoder that allows attackers to exhaust memory because vp9 decode frame() skips resetting the CBS fragment on error paths. Attackers can supply a crafted VP9 stream with invalid tile sizes decoded with slice threading to leak packet buffers and units, exhausting memory in the decoding application.
Found an issue in the description? Have something to add? Feel free to write us 👾