Integer Overflow in FFmpeg Affecting Vulkan Decoding

CVE-2026-125249

What is CVE-2026-125249?

An integer overflow vulnerability exists in FFmpeg versions 7.1 through 9.0.2 in the function ff_vk_decode_add_slice() found in libavcodec/vulkan_decode.c. This flaw miscalculates the size of the Vulkan hwaccel bitstream buffer, enabling attackers to craft a malicious stream with over 2 GiB of slice data per frame. This can lead to memcpy() functions writing beyond the bounds of a smaller pooled host-mapped buffer, potentially leading to data corruption or exploitation.

References