FFMPEG · CVE-2026-125219 · Package
NO FIX YET · SEE WHAT TO DO
FFmpeg's VDPAU HEVC decoder copies unbounded tile counts from a video's parameter set into fixed-size arrays, causing a heap buffer overflow. An attacker who supplies a crafted HEVC bitstream can write controlled 16-bit values past heap memory in applications that decode with VDPAU.
first public Nov 9, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Systems that decode HEVC video with FFmpeg through the VDPAU hardware path, especially when the video comes from untrusted sources such as uploads or user-supplied streams. Builds or deployments that do not use VDPAU for HEVC decoding are likely not reached by this code path, but the sources do not state this explicitly.
Not affected if no-untrusted-video, no-vdpau-decoding
Who cares ffmpeg, hevc, media-processing, vdpau
ffmpeg -hwaccels; if vdpau is not listed, this code path is not built in.ffmpeg -version; versions through 9.0.2 are affected per VulnCheck. No fixed release exists yet.FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in vdpau_hevc_start_frame() in libavcodec/vdpau_hevc.c that copies unbounded PPS tile counts into fixed-size VDPAU arrays. Attackers can supply crafted HEVC bitstreams with excessive tile columns or rows to write controlled 16-bit values past heap-allocated hwaccel data, corrupting memory in applications using VDPAU decoding.
This page as .md · .json · CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.