LOWCVSS v3.1 2.5Vulnerability
CVE-2026-125198
FFmpeg through 9.0.2 contains a memory leak vulnerability in mediaformat_jni_setBuffer() in libavcodec/mediacodec_wrapper.c that never frees buffers wrapped with NewDirectByteBuffer(). Attackers can supply crafted media files with large extradata, leaking native memory on each MediaCodec decoder configuration in Android applications and causing resource exhaustion.
Properties
- Severity
- LOW
- Nvd fetched at
- 2026-11-10T23:33:48.924589+00:00
- Epss score
- 0.0012
- Cvss severity
- LOW
- Cvss score
- 2.5
- Retrieved at
- 2026-11-10T23:35:17+00:00
- Last source
- FIRST EPSS
- Score
- 2.5
- Cvss version
- 3.1
- Cve id
- CVE-2026-125198
- Cvss vector
- CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
- First seen by Signal
- 2026-11-09T23:18:15+00:00
- Name
- CVE-2026-125198
- Vector
- CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
- Published at
- 2026-11-09T19:16:55.977
- Last modified
- 2026-11-10T21:46:30.177
- Epss percentile
- 0.01806
Related Entities (1)
HAS_WEAKNESS (1)
Related research
Explore deeper with Ninja Signal's threat intelligence graph