CVE-2026-125223 · Package
NO FIX YET · SEE WHAT TO DO
FFmpeg versions 8.0 through 9.0.2 have a VP9 decoder bug where error paths skip resetting the CBS fragment, so packet buffers and units leak. A crafted VP9 stream with invalid tile sizes, decoded with slice threading, can exhaust memory in the decoding application.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Systems that decode VP9 video from untrusted sources with FFmpeg 8.0 through 9.0.2, especially with slice threading enabled. Applications that only process trusted media or use other FFmpeg versions are not exposed by this flaw.
Not affected if no-vp9-decoding, other-versions, trusted-input-only
Who cares ffmpeg, media-processing, self-hosted, vp9
ffmpeg -version and compare against the affected range 8.0 through 9.0.2.9.0.2 that includes the upstream patch; the exact fixed version is unknown from the sources.FFmpeg 8.0 through 9.0.2 contains a memory leak vulnerability in the VP9 decoder that allows attackers to exhaust memory because vp9_decode_frame() skips resetting the CBS fragment on error paths. Attackers can supply a crafted VP9 stream with invalid tile sizes decoded with slice threading to leak packet buffers and units, exhausting memory in the decoding application.
This page as .md · .json · CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.