CVE-2026-125255

Description

FFmpeg through 9.0.2 contains a use after free vulnerability in libavcodec/mjpegdec.c that allows attackers to trigger freed buffer reads by sending a SOF marker without a preceding SOI. Attackers can supply crafted MJPEG streams causing ff_mjpeg_decode_sof() to pass a stale raw_image_buffer pointer to hwaccel decoders like NVDEC, crashing applications or leaking heap contents.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

References

• https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25231 ↗
• https://github.com/FFmpeg/FFmpeg/commit/f58a6776546567367baf5223df9ffbfd289299f8 ↗
• https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/mjpegdec.c#L831 ↗
• https://github.com/FFmpeg/FFmpeg ↗
• https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-use-after-free-in-mjpeg-hardware-accelerated-decoding ↗