Description
FFmpeg through 9.0.2 contains a memory leak vulnerability in mediaformat_jni_setBuffer() in libavcodec/mediacodec_wrapper.c that never frees buffers wrapped with NewDirectByteBuffer(). Attackers can supply crafted media files with large extradata, leaking native memory on each MediaCodec decoder configuration in Android applications and causing resource exhaustion.
Published: 2026-11-09
Score: 2 Low
EPSS: n/a
KEV: No
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 09 Nov 2026 19:15:00 +0000

Type Values Removed Values Added
Description FFmpeg through 9.0.2 contains a memory leak vulnerability in mediaformat_jni_setBuffer() in libavcodec/mediacodec_wrapper.c that never frees buffers wrapped with NewDirectByteBuffer(). Attackers can supply crafted media files with large extradata, leaking native memory on each MediaCodec decoder configuration in Android applications and causing resource exhaustion.
Title FFmpeg through 9.0.2 Memory Leak via MediaCodec JNI setBuffer
First Time appeared Ffmpeg
Ffmpeg ffmpeg
Weaknesses CWE-401
CPEs cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*
Vendors & Products Ffmpeg
Ffmpeg ffmpeg
References
Metrics cvssV3_1

{'score': 2.5, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L'}

cvssV4_0

{'score': 2, 'vector': 'CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'}

Subscriptions

Ffmpeg Ffmpeg
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-11-09T19:11:18.674Z

Reserved: 2026-11-09T18:15:11.265Z

Link: CVE-2026-125198

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-11-09T19:16:55.977

Modified: 2026-11-09T19:16:55.977

Link: CVE-2026-125198

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-09T21:15:14Z

Weaknesses
  • CWE-401

    Missing Release of Memory after Effective Lifetime