{"id":"CVE-2026-125207","kind":"vulnerability","aliases":["CVE-2026-125207"],"related":[],"title":"FFmpeg: crafted Interplay ACM file exhausts memory and crashes decoding","description":"FFmpeg through 9.0.2 contains an uncontrolled memory allocation vulnerability in the Interplay ACM decoder that allows attackers to exhaust memory via an attacker-controlled block size. Attackers can supply a crafted ACM file with maximum level and row count in extradata, making decode_init() allocate nearly a gigabyte and deny service.","summary":"FFmpeg's Interplay ACM audio decoder allocates close to a gigabyte of memory when a crafted ACM file sets maximum level and row count in its extradata. An attacker who gets such a file to FFmpeg can exhaust memory and deny service.","severity":"medium","cvss":6.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ffmpeg","media-processing","runtime","self-hosted"],"not_affected_if":["no-untrusted-media"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-09T19:16:57+00:00","first_seen_at":"2026-11-09T19:28:18+00:00","triaged_at":"2026-11-09T19:31:25+00:00","updated_at":"2026-11-09T19:31:25+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-09T19:31:25Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"FFmpeg: crafted Interplay ACM file exhausts memory and crashes decoding","impact":"low","summary":"FFmpeg's Interplay ACM audio decoder allocates close to a gigabyte of memory when a crafted ACM file sets maximum level and row count in its extradata. An attacker who gets such a file to FFmpeg can exhaust memory and deny service.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["ffmpeg","media-processing","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Memory exhaustion causes denial of service on the decoding process","analyst_note":"Confirm the fixed FFmpeg version and the patch details at the linked github.com patch and the vulncheck advisory; the sources give no version or how-to-check.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-untrusted-media"],"who_is_affected":"Systems that run FFmpeg to decode untrusted media files, such as upload-processing or transcoding services, are the ones to look at. The sources do not state which FFmpeg versions carry the fix, and they do not say whether anything beyond the decoder is involved. Teams that never decode Interplay ACM audio from outside sources can skip it.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00073,"input_tokens":4618,"output_tokens":536,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125207':13A,16A '-2026':12A,15A '9.0.2':69C 'acm':4A,28B,41B,79C,99C 'alloc':31B,74C,112C 'allow':82C 'attack':53B,83C,90C,94C 'attacker-control':89C 'audio':29B 'block':92C 'close':32B 'contain':70C 'control':91C 'count':48B,106C 'craft':2A,40B,98C 'crash':9A 'cve':11A,14A 'decod':10A,30B,80C,110C 'deni':65B,117C 'exhaust':6A,62B,85C 'extradata':51B,108C 'ffmpeg':1A,17B,25B,60B,67C 'file':5A,42B,58B,100C 'get':55B 'gigabyt':35B,115C 'host':24B 'init':111C 'interplay':3A,27B,78C 'level':45B,103C 'make':109C 'maximum':44B,102C 'media':19B 'media-process':18B 'memori':7A,37B,63B,73C,86C 'near':113C 'process':20B 'row':47B,105C 'runtim':21B 'self':23B 'self-host':22B 'servic':66B,118C 'set':43B 'size':93C 'suppli':96C 'uncontrol':72C 'via':87C 'vulner':75C","nicknames":[],"mitigations":[],"who_affected":"Systems that run FFmpeg to decode untrusted media files, such as upload-processing or transcoding services, are the ones to look at. The sources do not state which FFmpeg versions carry the fix, and they do not say whether anything beyond the decoder is involved. Teams that never decode Interplay ACM audio from outside sources can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ffmpeg","mediaprocessing","medium","runtime","selfhosted"],"campaign_type":null,"search_a":"'-125207':13A,16A '-2026':12A,15A 'acm':4A 'craft':2A 'crash':9A 'cve':11A,14A 'decod':10A 'exhaust':6A 'ffmpeg':1A 'file':5A 'interplay':3A 'memori':7A","search_b":"'acm':28B,41B 'alloc':31B 'attack':53B 'audio':29B 'close':32B 'count':48B 'craft':40B 'decod':30B 'deni':65B 'exhaust':62B 'extradata':51B 'ffmpeg':17B,25B,60B 'file':42B,58B 'get':55B 'gigabyt':35B 'host':24B 'interplay':27B 'level':45B 'maximum':44B 'media':19B 'media-process':18B 'memori':37B,63B 'process':20B 'row':47B 'runtim':21B 'self':23B 'self-host':22B 'servic':66B 'set':43B","search_c":"'9.0.2':69C 'acm':79C,99C 'alloc':74C,112C 'allow':82C 'attack':83C,90C,94C 'attacker-control':89C 'block':92C 'contain':70C 'control':91C 'count':106C 'craft':98C 'decod':80C,110C 'deni':117C 'exhaust':85C 'extradata':108C 'ffmpeg':67C 'file':100C 'gigabyt':115C 'init':111C 'interplay':78C 'level':103C 'make':109C 'maximum':102C 'memori':73C,86C 'near':113C 'row':105C 'servic':118C 'size':93C 'suppli':96C 'uncontrol':72C 'via':87C 'vulner':75C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T19:16:57+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125207","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125207","severity":null,"published_at":"2026-11-09T19:16:57+00:00","modified_at":"2026-11-09T19:16:57+00:00","first_seen_at":"2026-11-09T19:28:18+00:00","fetched_at":"2026-11-09T19:28:18+00:00","note":null}],"documents":[{"id":109304,"url":"https://github.com/FFmpeg/FFmpeg/commit/6ecaddb9c1d59cf7f5de16017122fecb2fa0c67c","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109305,"url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-excessive-memory-allocation-via-interplay-acm-decoder","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}