Use-After-Free Vulnerability in FFmpeg Affects Media Applications
CVE-2026-125265

5.8MEDIUM

Key Information:

Vendor

Ffmpeg

Status
Ffmpeg
Vendor
CVE Published:
9 November 2026

What is CVE-2026-125265?

FFmpeg, up to version 9.0.2, is susceptible to a use-after-free vulnerability in its NVDEC decoding library. This flaw arises in the handling of video frames where the ff_nvdec_start_frame() function fails to properly reset the bitstream context after encountering slice errors. An attacker can exploit this vulnerability by providing specially crafted video inputs that prematurely abandon a picture before the end of the frame processing. This can lead to the function cuvidDecodePicture() reading from freed heap memory, potentially resulting in application crashes or revealing sensitive data from stale memory contents.

Affected Version(s)

FFmpeg 0 <= 9.0.2

References

https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25231
issue-tracking
https://github.com/FFmpeg/FFmpeg/commit/03cd7851955c023f1...
patch
https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/n...
technical-description

CVSS V4

Score:
5.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Joshua Rogers (AISLE Research)
Michael Niedermayer
.