CVE-2026-125198

low

Description

FFmpeg through 9.0.2 contains a memory leak vulnerability in mediaformat_jni_setBuffer() in libavcodec/mediacodec_wrapper.c that never frees buffers wrapped with NewDirectByteBuffer(). Attackers can supply crafted media files with large extradata, leaking native memory on each MediaCodec decoder configuration in Android applications and causing resource exhaustion.

References

https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-memory-leak-via-mediacodec-jni-setbuffer

https://github.com/FFmpeg/FFmpeg/commit/e5d295b3cd467fc713300e208ba2dacc7ff603a0

https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/mediacodec_wrapper.c#L1134

https://github.com/FFmpeg/FFmpeg

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-120287

https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22550

Details

Source: Mitre, NVD

Published: 2026-11-09

Updated: 2026-11-10

Risk Information

CVSS v2

Base Score: 1.2

Vector: CVSS2#AV:L/AC:H/Au:N/C:N/I:N/A:P

Severity: Low

CVSS v3

Base Score: 2.5

Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L

Severity: Low

CVSS v4

Base Score: 2

Vector: CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Severity: Low

EPSS

EPSS: 0.0012