CVE-2026-125269
FFmpeg through 9.0.2 contains a double free vulnerability in libavcodec/cbs_sei.c where cbs_sei_delete_message() leaves a stale extension_data reference that ff_cbs_sei_add_message() reuses. Attackers can supply a crafted H.264 stream with a display orientation SEI message followed by payload extension data, processed by h264_metadata with display_orientation=insert, to corrupt heap memory.
- Score
- 7.3 high
- Published
- 2026-11-09
- Links
- NVD · cve.org · Report wrong data
Matched ports (5)
| Port | Package | Version | Status | Maintainer |
|---|---|---|---|---|
| multimedia/ffmpeg | ffmpeg | 9.0.2_3,1 | unaddressed | multimedia@FreeBSD.org |
| multimedia/ffmpeg | ffmpeg-nox11 | 9.0.2_3,1 | unaddressed | multimedia@FreeBSD.org |
| multimedia/ffmpeg3 | ffmpeg3 | 3.0.2_1 | unaddressed | kreinholz@gmail.com |
| multimedia/ffmpeg4 | ffmpeg4 | 4.4.8_2 | unaddressed | monwarez@mailoo.org |
| multimedia/linux-rl9-ffmpeg | linux-rl9-ffmpeg-libs | 7.1.5 | possibly backported | emulation@FreeBSD.org |
Template for a VuXML entry
Check the version numbers before you commit this entry. Some ports share an entry in the CVE database with another port, such as sqlite2 and sqlite3. The version shown here may then be one that never existed for this port.
Ranges per package from the CVE rows that match this port, in pkg notation with the port's epoch and revision, every bound checked with pkg; one range per epoch the port actually had. make newentry in security/vuxml creates the vid.
<vuln vid="FIXME (make newentry)">
<topic>ffmpeg -- FIXME</topic>
<affects>
<package>
<name>ffmpeg</name>
<name>ffmpeg-nox11</name>
<range><le>9.0.2_3,1</le></range>
</package>
<package>
<name>ffmpeg3</name>
<name>ffmpeg4</name>
<range><le>9.0.2</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>CVE-2026-125269: FFmpeg through 9.0.2 contains a double free
vulnerability in libavcodec/cbs_sei.c where
cbs_sei_delete_message() leaves a stale extension_data reference
that ff_cbs_sei_add_message() reuses. Attackers can supply a
crafted H.264 stream with a display orientation SEI message
followed by payload extension data, processed by h264_metadata with
display_orientation=insert, to corrupt heap memory.</p>
</body>
</description>
<references>
<cvename>CVE-2026-125269</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2026-125269</url>
</references>
<dates>
<discovery>2026-11-09</discovery>
<entry>2026-11-10</entry>
</dates>
</vuln>