CVE-2026-125269

HIGH 7.0

FFmpeg through 9.0.2 Double Free via cbs_sei_delete_message in cbs_sei.c

CVSS Score

7.0

EPSS Score

0.0%

EPSS Percentile

0th

FFmpeg through 9.0.2 contains a double free vulnerability in libavcodec/cbs_sei.c where cbs_sei_delete_message() leaves a stale extension_data reference that ff_cbs_sei_add_message() reuses. Attackers can supply a crafted H.264 stream with a display orientation SEI message followed by payload extension data, processed by h264_metadata with display_orientation=insert, to corrupt heap memory.

CWE	CWE-415
Vendor	ffmpeg
Product	ffmpeg
Published	Nov 9, 2026

Stay Ahead of the Next One

Get instant alerts for ffmpeg ffmpeg

Be the first to know when new high vulnerabilities affecting ffmpeg ffmpeg are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

FFmpeg / FFmpeg

0 ≤ 9.0.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

code.ffmpeg.org: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25020 github.com: https://github.com/FFmpeg/FFmpeg/commit/2c515eea07df719379e7f73deeeb7ccb8768433f github.com: https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/cbs_sei.c#L287 github.com: https://github.com/FFmpeg/FFmpeg vulncheck.com: https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-double-free-via-cbs-sei-delete-message-in-cbs-sei-c

Credits

Claude and Ada Logics 🔍 Joshua Rogers (AISLE Research) Michael Niedermayer