CVE-2026-125269 FFmpeg through 9.0.2 Double Free via cbs_sei_delete_message in cbs_sei.c
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-125269?
CVE-2026-125269 is a high-severity vulnerability in FFmpeg, published on 9 Nov 2026.
Official description
FFmpeg through 9.0.2 contains a double free vulnerability in libavcodec/cbs_sei.c where cbs_sei_delete_message() leaves a stale extension_data reference that ff_cbs_sei_add_message() reuses. Attackers can supply a crafted H.264 stream with a display orientation SEI message followed by payload extension data, processed by h264_metadata with display_orientation=insert, to corrupt heap memory.
Weakness: CWE-415
Which versions are affected by CVE-2026-125269?
How do I fix CVE-2026-125269?
No fix has been published for CVE-2026-125269 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-125269 being exploited?
There is no known exploitation of CVE-2026-125269 in the wild and no public exploit code.
Sources
Also known as GHSA-jg49-h5w2-rr7x, UBUNTU-CVE-2026-125269.