---
id: CVE-2026-125198
title: FFmpeg through 9.0.2 Memory Leak via MediaCodec JNI setBuffer
summary: >-
  FFmpeg through 9.0.2 contains a memory leak vulnerability in
  mediaformat_jni_setBuffer() in libavcodec/mediacodec_wrapper.c that never
  frees buffers wrapped with NewDirectByteBuffer(). Attackers can supply crafted
  media files with large …
severity: low
cvss: 2.5
cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L'
cvssSource: cna
cwe:
  - CWE-401
vendor: FFmpeg
product: FFmpeg
affected:
  - FFmpeg <= 9.0.2
published: '2026-11-09'
updated: '2026-11-09'
sourceUpdated: '2026-11-09T19:11:18.674Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-125198'
references:
  - url: 'https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22550'
  - url: >-
      https://github.com/FFmpeg/FFmpeg/commit/e5d295b3cd467fc713300e208ba2dacc7ff603a0
    label: Patch Commit
  - url: >-
      https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/mediacodec_wrapper.c#L1134
  - url: 'https://github.com/FFmpeg/FFmpeg'
  - url: >-
      https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-memory-leak-via-mediacodec-jni-setbuffer
    label: >-
      VulnCheck Advisory: FFmpeg through 9.0.2 Memory Leak via MediaCodec JNI
      setBuffer
tags:
  - cve.org
ingestedAt: '2026-11-09T19:18:02.602Z'
---

## Overview

FFmpeg through 9.0.2 contains a memory leak vulnerability in mediaformat_jni_setBuffer() in libavcodec/mediacodec_wrapper.c that never frees buffers wrapped with NewDirectByteBuffer(). Attackers can supply crafted media files with large extradata, leaking native memory on each MediaCodec decoder configuration in Android applications and causing resource exhaustion.

## Affected

- `FFmpeg <= 9.0.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.