CVE-2026-125173

MEDIUM 5.5

FFmpeg through 9.0.2 Memory Leak in libxevd EVC Decoder Wrapper

CVSS Score

5.5

EPSS Score

0.0%

EPSS Percentile

0th

FFmpeg through 9.0.2 contains a memory leak vulnerability in libxevd_receive_frame() in libavcodec/libxevd.c that fails to free pkt_au when an access unit produces no picture. Attackers can supply a crafted EVC stream with many access units containing only parameter sets or non-frame NAL units to exhaust memory in the decoding application.

CWE	CWE-401
Vendor	ffmpeg
Product	ffmpeg
Published	Nov 9, 2026

Stay Ahead of the Next One

Get instant alerts for ffmpeg ffmpeg

Be the first to know when new medium vulnerabilities affecting ffmpeg ffmpeg are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Affected Versions

FFmpeg / FFmpeg

7.0 ≤ 9.0.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

code.ffmpeg.org: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25416 github.com: https://github.com/FFmpeg/FFmpeg/commit/250303c2a59a71bfc544a6b583bc17b6cf0ca903 github.com: https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/libxevd.c#L341 github.com: https://github.com/FFmpeg/FFmpeg vulncheck.com: https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-memory-leak-in-libxevd-evc-decoder-wrapper

Credits

Joshua Rogers (AISLE Research) Michael Niedermayer