FFMPEG · CVE-2026-125269 · Runtime
NO FIX YET · SEE WHAT TO DO
FFmpeg through 9.0.2 has a double free in its SEI handling code, reachable when h264_metadata processes a crafted H.264 stream with display orientation SEI and extension data. An attacker who gets such a file processed can corrupt heap memory, which can lead to code execution.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Systems that run FFmpeg on H.264 files from outside sources, such as media transcoding services or upload pipelines, are exposed when they use the h264_metadata filter with display_orientation=insert. Local use on trusted files, or builds that never run that filter, are unlikely to be affected.
Not affected if filter-not-used, trusted-input-only
Who cares ffmpeg, h264, media-processing
ffmpeg -version and compare it to the fixed release in the product data (sources list FFmpeg through 9.0.2 as affected)h264_metadata with display_orientation=insert on untrusted inputFFmpeg through 9.0.2 contains a double free vulnerability in libavcodec/cbs_sei.c where cbs_sei_delete_message() leaves a stale extension_data reference that ff_cbs_sei_add_message() reuses. Attackers can supply a crafted H.264 stream with a display orientation SEI message followed by payload extension data, processed by h264_metadata with display_orientation=insert, to corrupt heap memory.
This page as .md · .json · CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.