CVE-2026-125223 FFmpeg 8.0 through 9.0.2 Memory Leak in VP9 Decoder via vp9_decode_frame
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-125223?
CVE-2026-125223 is a medium-severity vulnerability in FFmpeg, published on 9 Nov 2026.
Official description
FFmpeg 8.0 through 9.0.2 contains a memory leak vulnerability in the VP9 decoder that allows attackers to exhaust memory because vp9_decode_frame() skips resetting the CBS fragment on error paths. Attackers can supply a crafted VP9 stream with invalid tile sizes decoded with slice threading to leak packet buffers and units, exhausting memory in the decoding application.
Weakness: CWE-401
Which versions are affected by CVE-2026-125223?
How do I fix CVE-2026-125223?
No fix has been published for CVE-2026-125223 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-125223 being exploited?
There is no known exploitation of CVE-2026-125223 in the wild and no public exploit code.
Sources
Also known as GHSA-vm4w-xj5q-cxj8, UBUNTU-CVE-2026-125223.