CVE-2026-125224

FFmpeg through 9.0.2 contains a denial of service vulnerability in libavcodec/vorbisparser.c that re-parses invalid extradata for every packet when validextradata remains false. Attackers can supply crafted Ogg or Matroska Vorbis streams with large invalid extradata and many packets to exhaust CP...

CVE-2026-125224 FFmpeg through 9.0.2 Vorbis Parser CPU Exhaustion via Invalid Extradata

FFmpeg through 9.0.2 contains a denial of service vulnerability in libavcodec/vorbisparser.c that re-parses invalid extradata for every packet when validextradata remains false. Attackers can supply crafted Ogg or Matroska Vorbis streams with large invalid extradata and many packets to exhaust CP...

CVE-2026-125224 FFmpeg through 9.0.2 Vorbis Parser CPU Exhaustion via Invalid Extradata

FFmpeg through 9.0.2 contains a denial of service vulnerability in libavcodec/vorbisparser.c that re-parses invalid extradata for every packet when validextradata remains false. Attackers can supply crafted Ogg or Matroska Vorbis streams with large invalid extradata and many packets to exhaust CP...

EUVD-2026-120313

FFmpeg through 9.0.2 contains a denial of service vulnerability in libavcodec/vorbisparser.c that re-parses invalid extradata for every packet when validextradata remains false. Attackers can supply crafted Ogg or Matroska Vorbis streams with large invalid extradata and many packets to exhaust CP...

CVE-2026-125224

FFmpeg versions through 9.0.2 are susceptible to a denial of service vulnerability in the libavcodec/vorbis_parser.c component. The root cause is that the parser re-parses invalid extradata for every packet whenever valid_extradata remains false. An attacker can exploit this by providing crafted ...

CVE-2026-125224: FFmpeg: FFmpeg through 9.0.2 contains a denial of service vulnerability in libavcodec/vorbis_parser.c that re-parses invalid…

FFmpeg through 9.0.2 contains a denial of service vulnerability in libavcodec/vorbisparser.c that re-parses invalid extradata for every packet when validextradata remains false. Attackers can supply crafted Ogg or Matroska Vorbis streams with large invalid extradata and many packets to exhaust CP...