Medium severity4.7NVD Advisory· Published Nov 9, 2026
CVE-2026-125252
CVE-2026-125252
Description
FFmpeg through 9.0.2 contains a memory leak vulnerability in libavcodec/vaapi_decode.c that allows attackers to exhaust memory by supplying streams with slice parse errors. Attackers can craft H.264 or other VAAPI-decoded video where later slices fail to parse on every frame, continuously leaking VA parameter and slice buffers plus driver and heap memory.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1Patches
Vulnerability mechanics
References
5- code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25231nvd
- github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/vaapi_decode.cnvd
- github.com/FFmpeg/FFmpeg/commit/4221a63ce869ade862557ca64693bf77f5032971nvd
- github.com/FFmpeg/FFmpeg/commit/838c660bb3cd66ba74981b453c14c79214f6ef92nvd
- www.vulncheck.com/advisories/ffmpeg-through-9.0.2-vaapi-memory-leak-via-abandoned-picture-buffersnvd
News mentions
0No linked articles in our index yet.