Memory Leak in FFmpeg Affects Video Processing Capabilities

CVE-2026-125242

What is CVE-2026-125242?

FFmpeg versions up to 9.0.2 exhibit a vulnerability in the libavcodec component, specifically within vdpau.c. This memory leak occurs when crafted H.264 streams are processed with malformed NAL units that improperly abandon pictures before they are finalized. Consequently, this leads to the continuous leaking of the bitstream_buffers table, which can exhaust heap memory resources and potentially result in a denial of service. Attackers can exploit this issue by repeatedly supplying malicious streams, thereby affecting the stability and performance of the affected systems.

References