MEDIUM 6.8 NVD
CVE-2026-125207
FFmpeg through 9.0.2 contains an uncontrolled memory allocation vulnerability in the Interplay ACM decoder that allows attackers to exhaust memory via an attack
FFmpeg through 9.0.2 contains an uncontrolled memory allocation vulnerability in the Interplay ACM decoder that allows attackers to exhaust memory via an attacker-controlled block size. Attackers can supply a crafted ACM file with maximum level and row count in extradata, making decode_init() allocate nearly a gigabyte and deny service.
References
- https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25703
- https://github.com/FFmpeg/FFmpeg
- https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/interplayacm.c#L101
- https://github.com/FFmpeg/FFmpeg/commit/6ecaddb9c1d59cf7f5de16017122fecb2fa0c67c
- https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-excessive-memory-allocation-via-
This medium severity vulnerability with a CVSS score of 6.8 was published on 2026-11-09 via NVD.
vulnfeed aggregates 17092 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.