Medium severity4.7NVD Advisory· Published Nov 9, 2026

CVE-2026-125245

Description

FFmpeg through 9.0.2 contains a memory leak vulnerability in ff_mjpeg_decode_sof() in libavcodec/mjpegdec.c, which overwrites the hwaccel_picture_private pointer without freeing it. Attackers can supply crafted MJPEG streams with repeated SOF markers or failing frames to leak hwaccel private data and hardware buffers under VAAPI or NVDEC decoding.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

FFmpeg/Ffmpegllm-fuzzy
Range: <=9.0.2

Patches

Vulnerability mechanics

References

code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25231nvd
github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/mjpegdec.cnvd
github.com/FFmpeg/FFmpeg/commit/50e9ef29be1766404115b0a4908fa3fd6ed7fa3fnvd
www.vulncheck.com/advisories/ffmpeg-through-9.0.2-memory-leak-in-mjpeg-hwaccel-sof-decodingnvd

News mentions

No linked articles in our index yet.

cvss	0.306
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000