CVE-2026-125198
Discovered by AISLEPUBLISHEDCWE-401
Description
FFmpeg through 9.0.2 contains a memory leak vulnerability in mediaformat_jni_setBuffer() in libavcodec/mediacodec_wrapper.c that never frees buffers wrapped with NewDirectByteBuffer(). Attackers can supply crafted media files with large extradata, leaking native memory on each MediaCodec decoder configuration in Android applications and causing resource exhaustion.
CVSS Base Scores
CVSS v4.02.0
CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
CVSS v3.1
2.5CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
Affected Products
| Vendor | Product | Version | Status |
|---|---|---|---|
| FFmpeg | FFmpeg | 0 | affected |
Credits
- Joshua Rogers (AISLE Research)(finder)
- 罗乾林(remediation developer)
References
- https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22550
- https://github.com/FFmpeg/FFmpeg/commit/e5d295b3cd467fc713300e208ba2dacc7ff603a0
- https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/mediacodec_wrapper.c#L1134
- https://github.com/FFmpeg/FFmpeg
- https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-memory-leak-via-mediacodec-jni-setbuffer