CVE-2026-125252

Description

FFmpeg through 9.0.2 contains a memory leak vulnerability in libavcodec/vaapi_decode.c that allows attackers to exhaust memory by supplying streams with slice parse errors. Attackers can craft H.264 or other VAAPI-decoded video where later slices fail to parse on every frame, continuously leaking VA parameter and slice buffers plus driver and heap memory.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

References

• https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25231 ↗
• https://github.com/FFmpeg/FFmpeg/commit/4221a63ce869ade862557ca64693bf77f5032971 ↗
• https://github.com/FFmpeg/FFmpeg/commit/838c660bb3cd66ba74981b453c14c79214f6ef92 ↗
• https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/vaapi_decode.c#L117 ↗
• https://github.com/FFmpeg/FFmpeg ↗
• https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-vaapi-memory-leak-via-abandoned-picture-buffers ↗