CVE-2026-125223

The FFmpeg versions 8.0 through 9.0.2 are vulnerable to a memory leak in the VP9 decoder . The root cause is that the vp9_decode_frame() function fails to reset the CBS fragment during error paths. An attacker can trigger this by providing a crafted VP9 stream featuring invalid tile sizes when de...

CVE-2026-125223

FFmpeg 8.0 through 9.0.2 contains a memory leak vulnerability in the VP9 decoder that allows attackers to exhaust memory because vp9decodeframe skips resetting the CBS fragment on error paths. Attackers can supply a crafted VP9 stream with invalid tile sizes decoded with slice threading to leak...

EUVD-2026-120312

FFmpeg 8.0 through 9.0.2 contains a memory leak vulnerability in the VP9 decoder that allows attackers to exhaust memory because vp9decodeframe skips resetting the CBS fragment on error paths. Attackers can supply a crafted VP9 stream with invalid tile sizes decoded with slice threading to leak...