Heap Buffer Overflow Vulnerability in FFmpeg Affects Multiple Decoding Processes

CVE-2026-125239

What is CVE-2026-125239?

FFmpeg, through version 9.0.2, is susceptible to a heap buffer overflow vulnerability stemming from the ff_dxva2_hevc_fill_picture_parameters() function. This vulnerability arises when attackers manipulate HEVC bitstreams to introduce unbounded non-uniform tile counts. By exploiting this flaw, cybercriminals can cause memory corruption, allowing them to write controlled 16-bit values beyond the confines of fixed-size DXVA arrays during the decoding process on Windows systems through DXVA2, D3D11VA, or D3D12VA.

References