CVE-2026-125226 · Package
NO FIX YET
FFmpeg's SBaGen decoder derives an unbounded frame size from the script's sample rate, so a crafted script with a very high sample rate makes it allocate huge audio frames. An attacker can exhaust memory and crash the process.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Systems that run FFmpeg through 9.0.2 and decode SBaGen scripts from untrusted input are exposed. Systems that do not process untrusted SBaGen files, or that run a newer build, can skip it. The sources do not state a fixed version beyond a linked patch.
Not affected if no-untrusted-input, sbagen-decoder-unused
Who cares ffmpeg, libavformat, media-processing
ffmpeg -version to see whether the installed build is FFmpeg 9.0.2 or earlier.No fix yet, per the sources.
FFmpeg through 9.0.2 contains an uncontrolled memory allocation vulnerability in sbg_read_header() in libavformat/sbgdec.c that derives an unbounded default frame size from the script's sample rate. Attackers can supply a crafted SBaGen script declaring a very high -r sample rate so the wavesynth decoder allocates enormous audio frames, exhausting memory and causing denial of service.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.