{"id":"CVE-2026-125205","kind":"vulnerability","aliases":["CVE-2026-125205"],"related":[],"title":"FFmpeg: crafted AV1 file exhausts memory and crashes media processing","description":"FFmpeg through 9.0.2 contains an unbounded memory allocation vulnerability in the av1_frame_merge bitstream filter that allows attackers to exhaust memory by never sending a temporal delimiter OBU. Attackers can supply a crafted .obu file opened by the AV1 OBU or Annex B demuxers, forcing unlimited OBU buffering per temporal unit and causing denial of service.","summary":"FFmpeg's av1_frame_merge bitstream filter buffers AV1 data without limit when a temporal delimiter is never sent. A crafted .obu file opened by the AV1 OBU or Annex B demuxer can exhaust memory and cause a denial of service.","severity":"medium","cvss":6.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["av1","ffmpeg","media-processing","package"],"not_affected_if":["filter-unused","trusted-input-only"],"how_to_check":"- Check the FFmpeg version with `ffmpeg -version`; affected releases are listed as through `9.0.2`\n- Check whether av1_frame_merge is used, for example in a pipeline that processes untrusted .obu or Annex B input","fix":null,"status":"open","published_at":"2026-11-09T19:16:57+00:00","first_seen_at":"2026-11-09T19:28:18+00:00","triaged_at":"2026-11-09T19:31:30+00:00","updated_at":"2026-11-09T19:31:30+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-09T19:31:30Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"FFmpeg: crafted AV1 file exhausts memory and crashes media processing","impact":"low","summary":"FFmpeg's av1_frame_merge bitstream filter buffers AV1 data without limit when a temporal delimiter is never sent. A crafted .obu file opened by the AV1 OBU or Annex B demuxer can exhaust memory and cause a denial of service.","audience":"developers","category":"package","nicknames":[],"who_cares":["ffmpeg","media-processing","av1"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker exhausts memory and crashes the FFmpeg process","analyst_note":"Check the linked patch on github.com and the VulnCheck advisory for the fixed version and exact trigger conditions.","how_to_check":"- Check the FFmpeg version with `ffmpeg -version`; affected releases are listed as through `9.0.2`\n- Check whether av1_frame_merge is used, for example in a pipeline that processes untrusted .obu or Annex B input","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["trusted-input-only","filter-unused"],"who_is_affected":"Systems that run FFmpeg to open AV1 OBU or Annex B files from untrusted sources can be exposed to memory exhaustion. Setups that only process trusted media, or do not use the av1_frame_merge filter, are less exposed. The sources do not say which ffmpeg versions are fixed.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000751,"input_tokens":4637,"output_tokens":574,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125205':13A,16A '-2026':12A,15A '9.0.2':66C 'alloc':71C 'allow':81C 'annex':52B,106C 'attack':82C,93C 'av1':3A,17B,25B,31B,49B,75C,103C 'b':53B,107C 'bitstream':28B,78C 'buffer':30B,112C 'caus':59B,117C 'contain':67C 'craft':2A,43B,97C 'crash':8A 'cve':11A,14A 'data':32B 'delimit':38B,91C 'demux':54B,108C 'denial':61B,118C 'exhaust':5A,56B,84C 'ffmpeg':1A,18B,23B,64C 'file':4A,45B,99C 'filter':29B,79C 'forc':109C 'frame':26B,76C 'limit':34B 'media':9A,20B 'media-process':19B 'memori':6A,57B,70C,85C 'merg':27B,77C 'never':40B,87C 'obu':44B,50B,92C,98C,104C,111C 'open':46B,100C 'packag':22B 'per':113C 'process':10A,21B 'send':88C 'sent':41B 'servic':63B,120C 'suppli':95C 'tempor':37B,90C,114C 'unbound':69C 'unit':115C 'unlimit':110C 'vulner':72C 'without':33B","nicknames":[],"mitigations":[],"who_affected":"Systems that run FFmpeg to open AV1 OBU or Annex B files from untrusted sources can be exposed to memory exhaustion. Setups that only process trusted media, or do not use the av1_frame_merge filter, are less exposed. The sources do not say which ffmpeg versions are fixed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["av1","ffmpeg","mediaprocessing","medium","package"],"campaign_type":null,"search_a":"'-125205':13A,16A '-2026':12A,15A 'av1':3A 'craft':2A 'crash':8A 'cve':11A,14A 'exhaust':5A 'ffmpeg':1A 'file':4A 'media':9A 'memori':6A 'process':10A","search_b":"'annex':52B 'av1':17B,25B,31B,49B 'b':53B 'bitstream':28B 'buffer':30B 'caus':59B 'craft':43B 'data':32B 'delimit':38B 'demux':54B 'denial':61B 'exhaust':56B 'ffmpeg':18B,23B 'file':45B 'filter':29B 'frame':26B 'limit':34B 'media':20B 'media-process':19B 'memori':57B 'merg':27B 'never':40B 'obu':44B,50B 'open':46B 'packag':22B 'process':21B 'sent':41B 'servic':63B 'tempor':37B 'without':33B","search_c":"'9.0.2':66C 'alloc':71C 'allow':81C 'annex':106C 'attack':82C,93C 'av1':75C,103C 'b':107C 'bitstream':78C 'buffer':112C 'caus':117C 'contain':67C 'craft':97C 'delimit':91C 'demux':108C 'denial':118C 'exhaust':84C 'ffmpeg':64C 'file':99C 'filter':79C 'forc':109C 'frame':76C 'memori':70C,85C 'merg':77C 'never':87C 'obu':92C,98C,104C,111C 'open':100C 'per':113C 'send':88C 'servic':120C 'suppli':95C 'tempor':90C,114C 'unbound':69C 'unit':115C 'unlimit':110C 'vulner':72C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T19:16:57+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125205","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125205","severity":null,"published_at":"2026-11-09T19:16:57+00:00","modified_at":"2026-11-09T19:16:57+00:00","first_seen_at":"2026-11-09T19:28:18+00:00","fetched_at":"2026-11-09T19:28:18+00:00","note":null}],"documents":[{"id":109300,"url":"https://github.com/FFmpeg/FFmpeg/commit/c90bbc2036bac67e95777638bdc86157a775858a","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109301,"url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-memory-exhaustion-via-av1-frame-merge-bitstream-filter","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}