CVE-2026-125173 · Runtime
NO FIX YET · SEE WHAT TO DO
FFmpeg's libxevd decoder fails to free a packet buffer when an access unit contains no picture. A crafted EVC stream with many such access units exhausts memory in the application that decodes it.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications that decode EVC (MPEG-5) video with FFmpeg's libxevd decoder are exposed, and an attacker needs to supply the stream to them. Systems that never decode untrusted EVC input can skip it. unknown whether a default build enables libxevd.
Not affected if no-evc-decoding, untrusted-input-absent
Who cares ffmpeg, self-hosted, video-processing
ffmpeg -version and compare it with the fixed release listed in the sources.ffmpeg -decoders | grep -i xevd).FFmpeg through 9.0.2 contains a memory leak vulnerability in libxevd_receive_frame() in libavcodec/libxevd.c that fails to free pkt_au when an access unit produces no picture. Attackers can supply a crafted EVC stream with many access units containing only parameter sets or non-frame NAL units to exhaust memory in the decoding application.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.