CVE-2026-125236 · Package
NO FIX YET · SEE WHAT TO DO
FFmpeg through 9.0.2 leaks SPS and PPS parameter-set references in alloc_frame() when frame buffer allocation fails while decoding VVC (H.266) video. An attacker who supplies a crafted VVC stream that keeps replacing parameter sets can grow memory use until the process is denied service.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Systems that run FFmpeg or libavcodec to decode VVC (H.266) video from untrusted sources, such as upload pipelines, transcoders or media servers. Setups that only decode trusted local files or do not handle VVC can skip it.
Not affected if no-vvc-decoding, trusted-input-only
Who cares ffmpeg, libavcodec, media-processing, vvc
ffmpeg -version and compare it to the fixed ranges in the sources.FFmpeg through 9.0.2 contains a memory leak vulnerability in alloc_frame() in libavcodec/vvc/refs.c that leaks SPS and PPS references when frame buffer allocation fails. Attackers can supply a crafted VVC (H.266) stream that repeatedly replaces parameter sets, steadily growing memory use and causing denial of service.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.