CVE-2026-125200
5.5 MEDIUMpublic exploit availablePublished 2026-11-09 · Updated 2026-11-10
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
FFmpeg through 9.0.2 contains a memory leak vulnerability in libavcodec/libx265.c because libx265_encode_frame() never frees the rpu.payload allocated by ff_dovi_rpu_generate(). Attackers can supply crafted Dolby Vision HEVC or AV1 files that leak one RPU allocation per encoded frame during libx265 transcoding, causing unbounded memory growth and denial of service.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weaknesses
CWE-401
Public exploit & PoC references
All references
- https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25416
- https://github.com/FFmpeg/FFmpeg
- https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/libx265.c#L880
- https://github.com/FFmpeg/FFmpeg/commit/8dc4af2bbbd0d650e299a3d327bd48c775120e11
- https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-memory-leak-via-libx265-dolby-vision-rpu-payloads
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- MEDIUMCVE-2026-101025
- MEDIUMCVE-2026-102005
- MEDIUMCVE-2026-102006
- MEDIUMCVE-2026-102032
- MEDIUMCVE-2026-102051
- MEDIUMCVE-2026-102053
- HIGHCVE-2026-102081
- UNSCOREDCVE-2026-102716PoC
Related by shared AI tags and CWE weakness class. Browse the full archive.