CVE-2026-125207 · Runtime
NO FIX YET
FFmpeg's Interplay ACM audio decoder allocates close to a gigabyte of memory when a crafted ACM file sets maximum level and row count in its extradata. An attacker who gets such a file to FFmpeg can exhaust memory and deny service.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Systems that run FFmpeg to decode untrusted media files, such as upload-processing or transcoding services, are the ones to look at. The sources do not state which FFmpeg versions carry the fix, and they do not say whether anything beyond the decoder is involved. Teams that never decode Interplay ACM audio from outside sources can skip it.
Not affected if no-untrusted-media
Who cares ffmpeg, media-processing, self-hosted
Unknown from the sources.
No fix yet, per the sources.
FFmpeg through 9.0.2 contains an uncontrolled memory allocation vulnerability in the Interplay ACM decoder that allows attackers to exhaust memory via an attacker-controlled block size. Attackers can supply a crafted ACM file with maximum level and row count in extradata, making decode_init() allocate nearly a gigabyte and deny service.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.