Medium severity4.7NVD Advisory· Published Nov 9, 2026

CVE-2026-125191

Description

FFmpeg through 9.0.2 contains a reference count leak in libavcodec/v4l2_buffers.c that allows attackers to deadlock the V4L2 mem2mem decoder on multi-plane capture formats. Attackers can supply crafted H.264, HEVC, or VP9 streams with resolution changes, making ff_v4l2_m2m_codec_reinit() wait forever and hang the decoding application.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

FFmpeg/Ffmpegllm-fuzzy
Range: <=9.0.2

Patches

Vulnerability mechanics

References

code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25682nvd
github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/v4l2_buffers.cnvd
github.com/FFmpeg/FFmpeg/commit/4d2d58efa9b9f3802893b1db0ea1edfbe1cc66efnvd
www.vulncheck.com/advisories/ffmpeg-through-9.0.2-v4l2-m2m-decoder-deadlock-via-reference-count-leaknvd

News mentions

No linked articles in our index yet.

cvss	0.306
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000