CVE-2026-125200 · Package
NO FIX YET
FFmpeg's libx265 encoder never frees a Dolby Vision RPU buffer for each encoded frame. A crafted Dolby Vision HEVC or AV1 file makes memory grow without limit, which can exhaust the machine and cause a denial of service.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Systems that run FFmpeg with libx265 to transcode media files, especially where users or external sources supply the files. Local one-off conversions of trusted files carry little exposure. unknown for the exact affected builds beyond 'through 9.0.2'.
Not affected if no-libx265, trusted-input-only
Who cares ffmpeg, libx265, media-transcoding
ffmpeg -version, and compare it against the fixed release in the product ranges (unknown in the sources).No fix yet, per the sources.
FFmpeg through 9.0.2 contains a memory leak vulnerability in libavcodec/libx265.c because libx265_encode_frame() never frees the rpu.payload allocated by ff_dovi_rpu_generate(). Attackers can supply crafted Dolby Vision HEVC or AV1 files that leak one RPU allocation per encoded frame during libx265 transcoding, causing unbounded memory growth and denial of service.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.