CVE-2026-125237 · Package
NO FIX YET
FFmpeg 8.1 through 9.0.2 leaks a Vulkan hardware-acceleration buffer in its DPX image decoder when callbacks fail. A crafted DPX file triggers an assertion abort on the next frame, terminating the decoding application.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Systems that run FFmpeg 8.1 through 9.0.2 to decode DPX images, especially on Vulkan hardware acceleration, when they accept images from untrusted sources. The sources do not say whether the default build exercises this path. Teams that do not decode DPX files with FFmpeg can skip it.
Not affected if no-dpx-input, no-untrusted-images
Who cares ffmpeg, media-processing, vulkan
ffmpeg -version) is within 8.1 through 9.0.2.No fix yet, per the sources.
FFmpeg 8.1 through 9.0.2 contains a denial of service vulnerability in libavcodec/dpx.c that leaves dpx->hwaccel_picture_private allocated when Vulkan hwaccel callbacks fail. Attackers can supply crafted DPX images that make start_frame, decode_slice or end_frame fail, triggering an av_assert0 abort on the next frame and terminating the decoding application.
This page as .md · .json · CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.