CVE-2026-125226 FFmpeg through 9.0.2 Excessive Memory Allocation via SBaGen Demuxer

Medium 6.8 Published 9 Nov 2026 Updated 9 Nov 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2026-125226?

CVE-2026-125226 is a medium-severity vulnerability in FFmpeg, published on 9 Nov 2026.

Official description

FFmpeg through 9.0.2 contains an uncontrolled memory allocation vulnerability in sbg_read_header() in libavformat/sbgdec.c that derives an unbounded default frame size from the script's sample rate. Attackers can supply a crafted SBaGen script declaring a very high -r sample rate so the wavesynth decoder allocates enormous audio frames, exhausting memory and causing denial of service.

Weakness: CWE-789

Which versions are affected by CVE-2026-125226?

How do I fix CVE-2026-125226?

No fix has been published for CVE-2026-125226 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-125226 being exploited?

There is no known exploitation of CVE-2026-125226 in the wild and no public exploit code.

Sources

Also known as GHSA-4rr8-hwwq-wfvq, UBUNTU-CVE-2026-125226.