FFMPEG · CVE-2026-125202 · Package
NO FIX YET · SEE WHAT TO DO
FFmpeg through 9.0.2 has a heap buffer overflow in the VAAPI HEVC decoder, where unbounded PPS tile counts are copied into fixed-size arrays. An attacker who supplies a crafted HEVC video can corrupt memory in applications that decode with VAAPI.
first public Nov 9, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Exposure requires an application that decodes HEVC video through FFmpeg's VAAPI hardware path and handles untrusted input such as uploaded or streamed video. Software that only uses FFmpeg's software decoders, or never decodes untrusted HEVC, is not described as affected by the sources.
Not affected if no-untrusted-hevc-input, software-decoding-only
Who cares ffmpeg, hevc, libavcodec, media-processing, vaapi
ffmpeg -version; versions up to and including 9.0.2 are affected per VulnCheck-hwaccel vaapi, or an app using libavcodec's VAAPI hwaccel) reach vaapi_hevc_start_frame()FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in vaapi_hevc_start_frame() in libavcodec/vaapi_hevc.c that copies unbounded PPS tile counts into fixed-size arrays. Attackers can supply a crafted HEVC bitstream with a large picture and many tiles to write controlled 16-bit values past heap-allocated hwaccel data, corrupting memory in applications decoding with VAAPI.
This page as .md · .json · CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.