CVE-2026-125240 · Runtime
NO FIX YET
FFmpeg through 9.0.2 leaks decoder instances and buffers in its SVT JPEG XS decoder when frame dimensions are rejected. A crafted JPEG XS stream, for example inside MPEG-TS, can repeatedly trigger the leak and exhaust memory.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Systems that run FFmpeg to decode untrusted media, such as transcoding services or media pipelines accepting uploaded or streamed MPEG-TS content, are the exposed ones. Installations that only process trusted local files, or that lack the SVT JPEG XS decoder, are less exposed. The sources do not say which FFmpeg version fixes it.
Not affected if no-svt-jpegxs-decoder, no-untrusted-input
Who cares ffmpeg, media-processing, self-hosted, transcoding
ffmpeg -version; versions through 9.0.2 are in the affected range.ffmpeg -decoders | grep -i jpegxs.No fix yet, per the sources.
FFmpeg through 9.0.2 contains a resource leak vulnerability in svt_jpegxs_dec_decode() in libsvtjpegxsdec.c that leaks decoder instances when ff_set_dimensions() rejects frame dimensions. Attackers can supply a crafted JPEG XS stream, for example in MPEG-TS, with oversized headers to repeatedly leak decoder threads and buffers, exhausting memory.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.