CVE-2026-125191 · Package
NO FIX YET · SEE WHAT TO DO
FFmpeg's V4L2 mem2mem decoder leaks a reference count in libavcodec/v4l2_buffers.c. A crafted H.264, HEVC, or VP9 stream with resolution changes makes the decoder wait forever, hanging the application that decodes it.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications that decode video through FFmpeg's V4L2 mem2mem hardware decoders, especially ones that accept untrusted files or streams. A hang is a denial of service; the sources do not say code execution is possible. Programs that use only software decoding, or never receive untrusted media, are unlikely to be exposed.
Not affected if no-untrusted-input, software-decoding-only
Who cares ffmpeg, libavcodec, linux, media-processing, v4l2
ffmpeg -decoders | grep v4l2m2m)ffmpeg -version; the sources say FFmpeg through 9.0.2 is affectedFFmpeg through 9.0.2 contains a reference count leak in libavcodec/v4l2_buffers.c that allows attackers to deadlock the V4L2 mem2mem decoder on multi-plane capture formats. Attackers can supply crafted H.264, HEVC, or VP9 streams with resolution changes, making ff_v4l2_m2m_codec_reinit() wait forever and hang the decoding application.
This page as .md · .json · CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.