FFMPEG · CVE-2026-125198 · Package
NO FIX YET
FFmpeg through 9.0.2 never frees direct byte buffers created in the Android MediaCodec wrapper, so each decoder configuration leaks native memory. An attacker who supplies crafted media with large extradata can exhaust memory in an Android app that uses it, causing resource exhaustion.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Android applications that build in FFmpeg's MediaCodec decoder path and decode media files from untrusted sources are exposed. Desktop builds, or apps that do not use the MediaCodec wrapper, are not described by the sources as affected. The sources do not give a patched version beyond a linked patch reference.
Not affected if no-mediacodec-build, trusted-media-only
Who cares android, ffmpeg, mediacodec
9.0.2.No fix yet, per the sources.
FFmpeg through 9.0.2 contains a memory leak vulnerability in mediaformat_jni_setBuffer() in libavcodec/mediacodec_wrapper.c that never frees buffers wrapped with NewDirectByteBuffer(). Attackers can supply crafted media files with large extradata, leaking native memory on each MediaCodec decoder configuration in Android applications and causing resource exhaustion.
This page as .md · .json · CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.