CVE-2026-125200
Discovered by AISLEPUBLISHEDCWE-401
Description
FFmpeg through 9.0.2 contains a memory leak vulnerability in libavcodec/libx265.c because libx265_encode_frame() never frees the rpu.payload allocated by ff_dovi_rpu_generate(). Attackers can supply crafted Dolby Vision HEVC or AV1 files that leak one RPU allocation per encoded frame during libx265 transcoding, causing unbounded memory growth and denial of service.
CVSS Base Scores
CVSS v4.06.8
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS v3.1
5.5CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Version | Status |
|---|---|---|---|
| FFmpeg | FFmpeg | 7.1 | affected |
Credits
- Joshua Rogers (AISLE Research)(finder)
- Michael Niedermayer(remediation developer)
References
- https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25416
- https://github.com/FFmpeg/FFmpeg/commit/8dc4af2bbbd0d650e299a3d327bd48c775120e11
- https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/libx265.c#L880
- https://github.com/FFmpeg/FFmpeg
- https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-memory-leak-via-libx265-dolby-vision-rpu-payloads