---
id: "CVE-2026-125198"
page: "https://infrastack.ai/live/CVE-2026-125198"
kind: "vulnerability"
aliases: ["CVE-2026-125198"]
title: "FFmpeg: crafted media files leak native memory on Android decoding"
severity: "low"
cvss: 2.5
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "FFmpeg", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["android", "ffmpeg", "mediacodec", "package"]
not_affected_if: ["no-mediacodec-build", "trusted-media-only"]
published_at: "2026-11-09T19:16:55+00:00"
first_seen_at: "2026-11-09T19:28:18+00:00"
updated_at: "2026-11-09T19:33:40+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-125198", "first_seen_at": "2026-11-09T19:28:18+00:00"}]
exploit_sources: []
---

# FFmpeg: crafted media files leak native memory on Android decoding

Link for people: https://infrastack.ai/live/CVE-2026-125198 (this .md is for agents)

FFmpeg through 9.0.2 never frees direct byte buffers created in the Android MediaCodec wrapper, so each decoder configuration leaks native memory. An attacker who supplies crafted media with large extradata can exhaust memory in an Android app that uses it, causing resource exhaustion.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:FFmpeg affected range not listed fixed no fixed version listed

## How to check

- Check whether the app ships or links FFmpeg's libavcodec with MediaCodec support (mediacodec_wrapper.c) on Android.
- Confirm the FFmpeg version in use; affected versions are listed as through `9.0.2`.

## Timeline

- 2026-11-09T19:28:18+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-125198

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-memory-leak-via-mediacodec-jni-setbuffer
- [fix] Patch: github.com https://github.com/FFmpeg/FFmpeg/commit/e5d295b3cd467fc713300e208ba2dacc7ff603a0

## From the sources

FFmpeg through 9.0.2 contains a memory leak vulnerability in mediaformat_jni_setBuffer() in libavcodec/mediacodec_wrapper.c that never frees buffers wrapped with NewDirectByteBuffer(). Attackers can supply crafted media files with large extradata, leaking native memory on each MediaCodec decoder configuration in Android applications and causing resource exhaustion.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_