Memory Leak Vulnerability in FFmpeg by FFmpeg.
CVE-2026-125252

5.7MEDIUM

Key Information:

Vendor

Ffmpeg

Status
Ffmpeg
Vendor
CVE Published:
9 November 2026

What is CVE-2026-125252?

A memory leak vulnerability has been identified in FFmpeg through version 9.0.2, affecting the libavcodec/vaapi_decode.c component. This flaw allows attackers to exploit streams containing H.264 or other VAAPI-decoded videos, where slice parsing errors can exhaust memory resources. By continuously providing modified video streams that lead to parsing failures on each frame, attackers can cause the exhaustion of VA parameters, slice buffers, and significant driver and heap memory. Proper mitigation strategies are necessary to reduce the risk involved with this vulnerability.

Affected Version(s)

FFmpeg 0 <= 9.0.2

References

https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25231
issue-tracking
https://github.com/FFmpeg/FFmpeg/commit/4221a63ce869ade86...
patch
https://github.com/FFmpeg/FFmpeg/commit/838c660bb3cd66ba7...
patch

CVSS V4

Score:
5.7
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Joshua Rogers (AISLE Research)
Michael Niedermayer
.