{"id":"CVE-2026-125202","kind":"vulnerability","aliases":["CVE-2026-125202"],"related":[],"title":"FFmpeg: crafted HEVC stream overflows heap during VAAPI hardware decoding","description":"FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in vaapi_hevc_start_frame() in libavcodec/vaapi_hevc.c that copies unbounded PPS tile counts into fixed-size arrays. Attackers can supply a crafted HEVC bitstream with a large picture and many tiles to write controlled 16-bit values past heap-allocated hwaccel data, corrupting memory in applications decoding with VAAPI.","summary":"FFmpeg through 9.0.2 has a heap buffer overflow in the VAAPI HEVC decoder, where unbounded PPS tile counts are copied into fixed-size arrays. An attacker who supplies a crafted HEVC video can corrupt memory in applications that decode with VAAPI.","severity":"high","cvss":7.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ffmpeg","fixed":[],"affected":"<= 9.0.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["ffmpeg","hevc","libavcodec","media-processing","package","vaapi"],"not_affected_if":["no-untrusted-hevc-input","software-decoding-only"],"how_to_check":"- Run `ffmpeg -version`; versions up to and including 9.0.2 are affected per VulnCheck\n- Only builds with VAAPI enabled and HEVC decoded via VAAPI (`-hwaccel vaapi`, or an app using libavcodec's VAAPI hwaccel) reach vaapi_hevc_start_frame()\n- Also check apps that bundle libavcodec (media servers, transcoders, thumbnailers) that accept untrusted HEVC on Linux with Intel/AMD GPUs\n- Workaround until a release: use software decoding for untrusted HEVC (omit -hwaccel vaapi)","fix":"No release contains a fix yet. Upstream PR 25136 (unmerged, open, milestone 9.1) has a VAAPI HEVC commit 3cd298c0d8 that rejects tile counts the picture parameters cannot hold.","status":"open","published_at":"2026-11-09T19:16:56+00:00","first_seen_at":"2026-11-09T19:28:18+00:00","triaged_at":"2026-11-09T19:30:10+00:00","updated_at":"2026-11-09T19:35:05+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-09T19:30:10Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"FFmpeg: crafted HEVC stream overflows heap during VAAPI hardware decoding","impact":"high","summary":"FFmpeg through 9.0.2 has a heap buffer overflow in the VAAPI HEVC decoder, where unbounded PPS tile counts are copied into fixed-size arrays. An attacker who supplies a crafted HEVC video can corrupt memory in applications that decode with VAAPI.","audience":"developers","category":"package","nicknames":[],"who_cares":["ffmpeg","libavcodec","vaapi","hevc","media-processing"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker-controlled data corrupts heap memory, potentially enabling code execution in the decoding process","analyst_note":"Confirm the fixed FFmpeg version and whether a patch exists via the NVD entry or the VulnCheck advisory; the sources do not state a fix.","how_to_check":"- Check the FFmpeg version with `ffmpeg -version`; the sources say versions through `9.0.2` are affected\n- Look for applications that decode HEVC through VAAPI hardware acceleration (`-hwaccel vaapi`) or link libavcodec with VAAPI enabled\n- unknown whether a fixed version exists in the sources","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["software-decoding-only","no-untrusted-hevc-input"],"who_is_affected":"Exposure requires an application that decodes HEVC video through FFmpeg's VAAPI hardware path and handles untrusted input such as uploaded or streamed video. Software that only uses FFmpeg's software decoders, or never decodes untrusted HEVC, is not described as affected by the sources.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000804,"input_tokens":4642,"output_tokens":680,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed FFmpeg version and whether a patch exists via the NVD entry or the VulnCheck advisory; the sources do not state a fix.","search":"'-125202':13A,16A '-2026':12A,15A '16':112C '9.0.2':28B,70C 'alloc':118C 'applic':63B,124C 'array':50B,94C 'attack':52B,95C 'bit':113C 'bitstream':101C 'buffer':32B,74C 'contain':71C 'control':111C 'copi':45B,85C 'corrupt':60B,121C 'count':43B,89C 'craft':2A,56B,99C 'cve':11A,14A 'data':120C 'decod':10A,38B,65B,125C 'ffmpeg':1A,17A,18B,26B,68C 'fix':48B,92C 'fixed-s':47B,91C 'frame':81C 'hardwar':9A 'heap':6A,31B,73C,117C 'heap-alloc':116C 'hevc':3A,19B,37B,57B,79C,100C 'hwaccel':119C 'larg':104C 'libavcodec':20B 'libavcodec/vaapi_hevc.c':83C 'mani':107C 'media':22B 'media-process':21B 'memori':61B,122C 'overflow':5A,33B,75C 'packag':24B 'past':115C 'pictur':105C 'pps':41B,87C 'process':23B 'size':49B,93C 'start':80C 'stream':4A 'suppli':54B,97C 'tile':42B,88C,108C 'unbound':40B,86C 'vaapi':8A,25B,36B,67B,78C,127C 'valu':114C 'video':58B 'vulner':76C 'write':110C","nicknames":[],"mitigations":[],"who_affected":"Exposure requires an application that decodes HEVC video through FFmpeg's VAAPI hardware path and handles untrusted input such as uploaded or streamed video. Software that only uses FFmpeg's software decoders, or never decodes untrusted HEVC, is not described as affected by the sources.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":["ffmpeg"],"ptokens":["ffmpeg"],"labels":["ffmpeg","hevc","high","libavcodec","mediaprocessing","package","vaapi"],"campaign_type":null,"search_a":"'-125202':13A,16A '-2026':12A,15A 'craft':2A 'cve':11A,14A 'decod':10A 'ffmpeg':1A,17A 'hardwar':9A 'heap':6A 'hevc':3A 'overflow':5A 'stream':4A 'vaapi':8A","search_b":"'9.0.2':28B 'applic':63B 'array':50B 'attack':52B 'buffer':32B 'copi':45B 'corrupt':60B 'count':43B 'craft':56B 'decod':38B,65B 'ffmpeg':18B,26B 'fix':48B 'fixed-s':47B 'heap':31B 'hevc':19B,37B,57B 'libavcodec':20B 'media':22B 'media-process':21B 'memori':61B 'overflow':33B 'packag':24B 'pps':41B 'process':23B 'size':49B 'suppli':54B 'tile':42B 'unbound':40B 'vaapi':25B,36B,67B 'video':58B","search_c":"'16':112C '9.0.2':70C 'alloc':118C 'applic':124C 'array':94C 'attack':95C 'bit':113C 'bitstream':101C 'buffer':74C 'contain':71C 'control':111C 'copi':85C 'corrupt':121C 'count':89C 'craft':99C 'data':120C 'decod':125C 'ffmpeg':68C 'fix':92C 'fixed-s':91C 'frame':81C 'heap':73C,117C 'heap-alloc':116C 'hevc':79C,100C 'hwaccel':119C 'larg':104C 'libavcodec/vaapi_hevc.c':83C 'mani':107C 'memori':122C 'overflow':75C 'past':115C 'pictur':105C 'pps':87C 'size':93C 'start':80C 'suppli':97C 'tile':88C,108C 'unbound':86C 'vaapi':78C,127C 'valu':114C 'vulner':76C 'write':110C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T19:16:56+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125202","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125202","severity":null,"published_at":"2026-11-09T19:16:56+00:00","modified_at":"2026-11-09T19:16:56+00:00","first_seen_at":"2026-11-09T19:28:18+00:00","fetched_at":"2026-11-09T19:28:18+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-125202:2332","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25136","severity":null,"published_at":"2026-11-09T19:35:05+00:00","modified_at":"2026-11-09T19:35:05+00:00","first_seen_at":"2026-11-09T19:35:05+00:00","fetched_at":"2026-11-09T19:35:05+00:00","note":"Read VulnCheck advisory (via WebFetch) and upstream PR 25136. No fixed release; PR unmerged. No PoC, no exploitation seen. Not verified: no vendor advisory. Exa and X not checked (credits out). Local attack vector per CVSS 4.0.","cites":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25136"]}],"documents":[{"id":109295,"url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-heap-buffer-overflow-via-hevc-vaapi-tile-arrays","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"},{"id":109481,"url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25136","title":"FFmpeg PR 25136: libavcodec fixes (HEVC/AV1 hwaccel tile arrays, Vulkan) - open","kind":"issue","source":"analyst","publisher":null,"text":"Open PR into master, milestone FFmpeg 9.1 branching, 0/1 approvals. Commit 21017c72db: vdpau_hevc rejects tile counts the VDPAU picture info cannot hold. Also vaapi, dxva2, vulkan HEVC tile-count checks. Each commit message cites a security report from AISLE.","published_at":null,"relation":"fix","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}