CVE-2026-125104

MEDIUM 5.5

FFmpeg through 9.0.2 Memory Exhaustion DoS via APE Decoder apedec.c

CVSS Score

5.5

EPSS Score

0.0%

EPSS Percentile

0th

FFmpeg through 9.0.2 contains a memory exhaustion vulnerability in ape_decode_frame() in libavcodec/apedec.c that fails to enforce the 73728-sample limit for legacy APE frames. Attackers can supply a crafted legacy Monkey's Audio file declaring an enormous nblocks value to force gigabyte-scale allocations and cause denial of service.

CWE	CWE-789
Vendor	ffmpeg
Product	ffmpeg
Published	Nov 9, 2026

Stay Ahead of the Next One

Get instant alerts for ffmpeg ffmpeg

Be the first to know when new medium vulnerabilities affecting ffmpeg ffmpeg are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Affected Versions

FFmpeg / FFmpeg

0 ≤ 9.0.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

code.ffmpeg.org: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25703 github.com: https://github.com/FFmpeg/FFmpeg/commit/968e9e948ed8c9ba90dbc875e60b843c755cf4ba github.com: https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/apedec.c#L1601 github.com: https://github.com/FFmpeg/FFmpeg vulncheck.com: https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-memory-exhaustion-dos-via-ape-decoder-apedec-c

Credits

Joshua Rogers (AISLE Research) Michael Niedermayer