{"id":"CVE-2026-125198","kind":"vulnerability","aliases":["CVE-2026-125198"],"related":[],"title":"FFmpeg: crafted media files leak native memory on Android decoding","description":"FFmpeg through 9.0.2 contains a memory leak vulnerability in mediaformat_jni_setBuffer() in libavcodec/mediacodec_wrapper.c that never frees buffers wrapped with NewDirectByteBuffer(). Attackers can supply crafted media files with large extradata, leaking native memory on each MediaCodec decoder configuration in Android applications and causing resource exhaustion.","summary":"FFmpeg through 9.0.2 never frees direct byte buffers created in the Android MediaCodec wrapper, so each decoder configuration leaks native memory. An attacker who supplies crafted media with large extradata can exhaust memory in an Android app that uses it, causing resource exhaustion.","severity":"low","cvss":2.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"FFmpeg","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["android","ffmpeg","mediacodec","package"],"not_affected_if":["no-mediacodec-build","trusted-media-only"],"how_to_check":"- Check whether the app ships or links FFmpeg's libavcodec with MediaCodec support (mediacodec_wrapper.c) on Android.\n- Confirm the FFmpeg version in use; affected versions are listed as through `9.0.2`.","fix":null,"status":"open","published_at":"2026-11-09T19:16:55+00:00","first_seen_at":"2026-11-09T19:28:18+00:00","triaged_at":"2026-11-09T19:33:40+00:00","updated_at":"2026-11-09T19:33:40+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-09T19:33:40Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"FFmpeg: crafted media files leak native memory on Android decoding","impact":"low","summary":"FFmpeg through 9.0.2 never frees direct byte buffers created in the Android MediaCodec wrapper, so each decoder configuration leaks native memory. An attacker who supplies crafted media with large extradata can exhaust memory in an Android app that uses it, causing resource exhaustion.","audience":"developers","category":"package","nicknames":[],"who_cares":["ffmpeg","android","mediacodec"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Native memory leaks until the app runs out of resources","analyst_note":"Confirm the fixed version and patch from the linked github.com patch reference and the vulncheck advisory; fix version not stated in sources.","how_to_check":"- Check whether the app ships or links FFmpeg's libavcodec with MediaCodec support (mediacodec_wrapper.c) on Android.\n- Confirm the FFmpeg version in use; affected versions are listed as through `9.0.2`.","plain_action":"","product_name":"FFmpeg","needs_analyst":true,"not_affected_if":["no-mediacodec-build","trusted-media-only"],"who_is_affected":"Android applications that build in FFmpeg's MediaCodec decoder path and decode media files from untrusted sources are exposed. Desktop builds, or apps that do not use the MediaCodec wrapper, are not described by the sources as affected. The sources do not give a patched version beyond a linked patch reference.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000766,"input_tokens":4633,"output_tokens":606,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-125198':13A,16A '-2026':12A,15A '9.0.2':24B,67C 'android':9A,18B,33B,57B,104C 'app':58B 'applic':105C 'attack':44B,86C 'buffer':29B,82C 'byte':28B 'caus':62B,107C 'configur':39B,102C 'contain':68C 'craft':2A,47B,89C 'creat':30B 'cve':11A,14A 'decod':10A,38B,101C 'direct':27B 'exhaust':53B,64B,109C 'extradata':51B,94C 'ffmpeg':1A,17A,19B,22B,65C 'file':4A,91C 'free':26B,81C 'jni':75C 'larg':50B,93C 'leak':5A,40B,71C,95C 'libavcodec/mediacodec_wrapper.c':78C 'media':3A,48B,90C 'mediacodec':20B,34B,100C 'mediaformat':74C 'memori':7A,42B,54B,70C,97C 'nativ':6A,41B,96C 'never':25B,80C 'newdirectbytebuff':85C 'packag':21B 'resourc':63B,108C 'setbuff':76C 'suppli':46B,88C 'use':60B 'vulner':72C 'wrap':83C 'wrapper':35B","nicknames":[],"mitigations":[],"who_affected":"Android applications that build in FFmpeg's MediaCodec decoder path and decode media files from untrusted sources are exposed. Desktop builds, or apps that do not use the MediaCodec wrapper, are not described by the sources as affected. The sources do not give a patched version beyond a linked patch reference.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":["ffmpeg"],"ptokens":["ffmpeg"],"labels":["android","ffmpeg","low","mediacodec","package","vendor"],"campaign_type":null,"search_a":"'-125198':13A,16A '-2026':12A,15A 'android':9A 'craft':2A 'cve':11A,14A 'decod':10A 'ffmpeg':1A,17A 'file':4A 'leak':5A 'media':3A 'memori':7A 'nativ':6A","search_b":"'9.0.2':24B 'android':18B,33B,57B 'app':58B 'attack':44B 'buffer':29B 'byte':28B 'caus':62B 'configur':39B 'craft':47B 'creat':30B 'decod':38B 'direct':27B 'exhaust':53B,64B 'extradata':51B 'ffmpeg':19B,22B 'free':26B 'larg':50B 'leak':40B 'media':48B 'mediacodec':20B,34B 'memori':42B,54B 'nativ':41B 'never':25B 'packag':21B 'resourc':63B 'suppli':46B 'use':60B 'wrapper':35B","search_c":"'9.0.2':67C 'android':104C 'applic':105C 'attack':86C 'buffer':82C 'caus':107C 'configur':102C 'contain':68C 'craft':89C 'decod':101C 'exhaust':109C 'extradata':94C 'ffmpeg':65C 'file':91C 'free':81C 'jni':75C 'larg':93C 'leak':71C,95C 'libavcodec/mediacodec_wrapper.c':78C 'media':90C 'mediacodec':100C 'mediaformat':74C 'memori':70C,97C 'nativ':96C 'never':80C 'newdirectbytebuff':85C 'resourc':108C 'setbuff':76C 'suppli':88C 'vulner':72C 'wrap':83C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T19:16:55+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125198","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125198","severity":null,"published_at":"2026-11-09T19:16:55+00:00","modified_at":"2026-11-09T19:16:55+00:00","first_seen_at":"2026-11-09T19:28:18+00:00","fetched_at":"2026-11-09T19:28:18+00:00","note":null}],"documents":[{"id":109287,"url":"https://github.com/FFmpeg/FFmpeg/commit/e5d295b3cd467fc713300e208ba2dacc7ff603a0","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109288,"url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-memory-leak-via-mediacodec-jni-setbuffer","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}