{"id":"CVE-2026-125219","kind":"vulnerability","aliases":["CVE-2026-125219"],"related":[],"title":"FFmpeg: crafted HEVC video overflows heap memory during VDPAU decoding","description":"FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in vdpau_hevc_start_frame() in libavcodec/vdpau_hevc.c that copies unbounded PPS tile counts into fixed-size VDPAU arrays. Attackers can supply crafted HEVC bitstreams with excessive tile columns or rows to write controlled 16-bit values past heap-allocated hwaccel data, corrupting memory in applications using VDPAU decoding.","summary":"FFmpeg's VDPAU HEVC decoder copies unbounded tile counts from a video's parameter set into fixed-size arrays, causing a heap buffer overflow. An attacker who supplies a crafted HEVC bitstream can write controlled 16-bit values past heap memory in applications that decode with VDPAU.","severity":"high","cvss":7.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ffmpeg","fixed":[],"affected":"<= 9.0.2","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["ffmpeg","hevc","media-processing","package","vdpau"],"not_affected_if":["no-untrusted-video","no-vdpau-decoding"],"how_to_check":"- Run `ffmpeg -hwaccels`; if `vdpau` is not listed, this code path is not built in.\n- Run `ffmpeg -version`; versions through 9.0.2 are affected per VulnCheck. No fixed release exists yet.\n- Check whether any app decodes HEVC from untrusted sources through FFmpeg with VDPAU (Linux with NVIDIA/VDPAU drivers).\n- Also check if you use VAAPI, DXVA2 or Vulkan HEVC decoding: the same PR adds the same tile-count checks there, but the sources only confirm VDPAU in this CVE.","fix":"No released fix yet. A candidate fix (commit 21017c72db, vdpau_hevc rejects tile counts the VDPAU picture info cannot hold) is in open, unmerged PR 25136 targeting master/9.1. Until a release ships it, avoid VDPAU for HEVC from untrusted sources, or build with the patch.","status":"open","published_at":"2026-11-09T19:16:59+00:00","first_seen_at":"2026-11-09T19:28:19+00:00","triaged_at":"2026-11-09T19:29:59+00:00","updated_at":"2026-11-09T19:33:03+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-09T19:29:59Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"FFmpeg: crafted HEVC video overflows heap memory during VDPAU decoding","impact":"high","summary":"FFmpeg's VDPAU HEVC decoder copies unbounded tile counts from a video's parameter set into fixed-size arrays, causing a heap buffer overflow. An attacker who supplies a crafted HEVC bitstream can write controlled 16-bit values past heap memory in applications that decode with VDPAU.","audience":"businesses","category":"package","nicknames":[],"who_cares":["ffmpeg","vdpau","hevc","media-processing"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker corrupts heap memory and may run code in the decoding process","analyst_note":"Find the fixed FFmpeg version and vendor advisory; the sources only cite NVD and VulnCheck, and the fix status is unknown.","how_to_check":"- Check whether the FFmpeg build includes VDPAU hardware decoding support, for example with `ffmpeg -hwaccels` listing `vdpau`\n- Check the installed version with `ffmpeg -version`; the sources say the flaw affects versions through `9.0.2`\n- Check whether your applications decode HEVC video from untrusted sources through FFmpeg with VDPAU","plain_action":"","product_name":"ffmpeg","needs_analyst":true,"not_affected_if":["no-vdpau-decoding","no-untrusted-video"],"who_is_affected":"Systems that decode HEVC video with FFmpeg through the VDPAU hardware path, especially when the video comes from untrusted sources such as uploads or user-supplied streams. Builds or deployments that do not use VDPAU for HEVC decoding are likely not reached by this code path, but the sources do not state this explicitly.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000812,"input_tokens":4648,"output_tokens":695,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the fixed FFmpeg version and vendor advisory; the sources only cite NVD and VulnCheck, and the fix status is unknown.","search":"'-125219':13A,16A '-2026':12A,15A '16':61B,116C '9.0.2':75C 'alloc':122C 'applic':68B,128C 'array':44B,100C 'attack':51B,101C 'bit':62B,117C 'bitstream':57B,106C 'buffer':48B,79C 'caus':45B 'column':110C 'contain':76C 'control':60B,115C 'copi':30B,90C 'corrupt':125C 'count':33B,94C 'craft':2A,55B,104C 'cve':11A,14A 'data':124C 'decod':10A,29B,70B,131C 'excess':108C 'ffmpeg':1A,17A,18B,25B,73C 'fix':42B,97C 'fixed-s':41B,96C 'frame':86C 'heap':6A,47B,65B,78C,121C 'heap-alloc':120C 'hevc':3A,19B,28B,56B,84C,105C 'hwaccel':123C 'libavcodec/vdpau_hevc.c':88C 'media':21B 'media-process':20B 'memori':7A,66B,126C 'overflow':5A,49B,80C 'packag':23B 'paramet':38B 'past':64B,119C 'pps':92C 'process':22B 'row':112C 'set':39B 'size':43B,98C 'start':85C 'suppli':53B,103C 'tile':32B,93C,109C 'unbound':31B,91C 'use':129C 'valu':63B,118C 'vdpau':9A,24B,27B,72B,83C,99C,130C 'video':4A,36B 'vulner':81C 'write':59B,114C","nicknames":[],"mitigations":[],"who_affected":"Systems that decode HEVC video with FFmpeg through the VDPAU hardware path, especially when the video comes from untrusted sources such as uploads or user-supplied streams. Builds or deployments that do not use VDPAU for HEVC decoding are likely not reached by this code path, but the sources do not state this explicitly.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["ffmpeg"],"ptokens":["ffmpeg"],"labels":["ffmpeg","hevc","high","mediaprocessing","package","vdpau","vendor"],"campaign_type":null,"search_a":"'-125219':13A,16A '-2026':12A,15A 'craft':2A 'cve':11A,14A 'decod':10A 'ffmpeg':1A,17A 'heap':6A 'hevc':3A 'memori':7A 'overflow':5A 'vdpau':9A 'video':4A","search_b":"'16':61B 'applic':68B 'array':44B 'attack':51B 'bit':62B 'bitstream':57B 'buffer':48B 'caus':45B 'control':60B 'copi':30B 'count':33B 'craft':55B 'decod':29B,70B 'ffmpeg':18B,25B 'fix':42B 'fixed-s':41B 'heap':47B,65B 'hevc':19B,28B,56B 'media':21B 'media-process':20B 'memori':66B 'overflow':49B 'packag':23B 'paramet':38B 'past':64B 'process':22B 'set':39B 'size':43B 'suppli':53B 'tile':32B 'unbound':31B 'valu':63B 'vdpau':24B,27B,72B 'video':36B 'write':59B","search_c":"'16':116C '9.0.2':75C 'alloc':122C 'applic':128C 'array':100C 'attack':101C 'bit':117C 'bitstream':106C 'buffer':79C 'column':110C 'contain':76C 'control':115C 'copi':90C 'corrupt':125C 'count':94C 'craft':104C 'data':124C 'decod':131C 'excess':108C 'ffmpeg':73C 'fix':97C 'fixed-s':96C 'frame':86C 'heap':78C,121C 'heap-alloc':120C 'hevc':84C,105C 'hwaccel':123C 'libavcodec/vdpau_hevc.c':88C 'memori':126C 'overflow':80C 'past':119C 'pps':92C 'row':112C 'size':98C 'start':85C 'suppli':103C 'tile':93C,109C 'unbound':91C 'use':129C 'valu':118C 'vdpau':83C,99C,130C 'vulner':81C 'write':114C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T19:16:59+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125219","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125219","severity":null,"published_at":"2026-11-09T19:16:59+00:00","modified_at":"2026-11-09T19:16:59+00:00","first_seen_at":"2026-11-09T19:28:19+00:00","fetched_at":"2026-11-09T19:28:19+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-125219:2326","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25136","severity":null,"published_at":"2026-11-09T19:33:03+00:00","modified_at":"2026-11-09T19:33:03+00:00","first_seen_at":"2026-11-09T19:33:03+00:00","fetched_at":"2026-11-09T19:33:03+00:00","note":"VulnCheck says <=9.0.2, no fixed version. FFmpeg PR 25136 (open, unmerged, 0/1 approvals) has vdpau_hevc fix 21017c72db; no vendor advisory on ffmpeg.org/security yet. web-cli search (credits) and X not used. Nothing verified: no primary vendor advisory with fix.","cites":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25136"]}],"documents":[{"id":109329,"url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-heap-buffer-overflow-via-hevc-vdpau-tile-arrays","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"},{"id":109481,"url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25136","title":"FFmpeg PR 25136: libavcodec fixes (HEVC/AV1 hwaccel tile arrays, Vulkan) - open","kind":"issue","source":"analyst","publisher":null,"text":"Open PR into master, milestone FFmpeg 9.1 branching, 0/1 approvals. Commit 21017c72db: vdpau_hevc rejects tile counts the VDPAU picture info cannot hold. Also vaapi, dxva2, vulkan HEVC tile-count checks. Each commit message cites a security report from AISLE.","published_at":null,"relation":"fix","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}