{"id":"CVE-2026-125237","kind":"vulnerability","aliases":["CVE-2026-125237"],"related":[],"title":"FFmpeg: crafted DPX image crashes decoder via leaked Vulkan allocation","description":"FFmpeg 8.1 through 9.0.2 contains a denial of service vulnerability in libavcodec/dpx.c that leaves dpx->hwaccel_picture_private allocated when Vulkan hwaccel callbacks fail. Attackers can supply crafted DPX images that make start_frame, decode_slice or end_frame fail, triggering an av_assert0 abort on the next frame and terminating the decoding application.","summary":"FFmpeg 8.1 through 9.0.2 leaks a Vulkan hardware-acceleration buffer in its DPX image decoder when callbacks fail. A crafted DPX file triggers an assertion abort on the next frame, terminating the decoding application.","severity":"medium","cvss":5.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ffmpeg","media-processing","package","vulkan"],"not_affected_if":["no-dpx-input","no-untrusted-images"],"how_to_check":"- Check whether the installed FFmpeg (`ffmpeg -version`) is within 8.1 through 9.0.2.\n- Look for applications that decode untrusted DPX images with FFmpeg's Vulkan hwaccel enabled.","fix":null,"status":"open","published_at":"2026-11-09T19:17:01+00:00","first_seen_at":"2026-11-09T19:28:20+00:00","triaged_at":"2026-11-09T19:32:01+00:00","updated_at":"2026-11-09T19:32:01+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-09T19:32:01Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"FFmpeg: crafted DPX image crashes decoder via leaked Vulkan allocation","impact":"low","summary":"FFmpeg 8.1 through 9.0.2 leaks a Vulkan hardware-acceleration buffer in its DPX image decoder when callbacks fail. A crafted DPX file triggers an assertion abort on the next frame, terminating the decoding application.","audience":"businesses","category":"package","nicknames":[],"who_cares":["ffmpeg","media-processing","vulkan"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Decoding application aborts, causing denial of service","analyst_note":"Confirm the fixed FFmpeg version and whether the Vulkan hwaccel path is enabled by default; check the vulncheck advisory and FFmpeg's security notes.","how_to_check":"- Check whether the installed FFmpeg (`ffmpeg -version`) is within 8.1 through 9.0.2.\n- Look for applications that decode untrusted DPX images with FFmpeg's Vulkan hwaccel enabled.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-dpx-input","no-untrusted-images"],"who_is_affected":"Systems that run FFmpeg 8.1 through 9.0.2 to decode DPX images, especially on Vulkan hardware acceleration, when they accept images from untrusted sources. The sources do not say whether the default build exercises this path. Teams that do not decode DPX files with FFmpeg can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000762,"input_tokens":4628,"output_tokens":598,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125237':13A,16A '-2026':12A,15A '8.1':24B,59C '9.0.2':26B,61C 'abort':49B,102C 'acceler':32B 'alloc':10A,76C 'applic':57B,111C 'assert':48B 'assert0':101C 'attack':82C 'av':100C 'buffer':33B 'callback':40B,80C 'contain':62C 'craft':2A,43B,85C 'crash':5A 'cve':11A,14A 'decod':6A,38B,56B,92C,110C 'denial':64C 'dpx':3A,36B,44B,72C,86C 'end':95C 'fail':41B,81C,97C 'ffmpeg':1A,17B,23B,58C 'file':45B 'frame':53B,91C,96C,106C 'hardwar':31B 'hardware-acceler':30B 'hwaccel':73C,79C 'imag':4A,37B,87C 'leak':8A,27B 'leav':71C 'libavcodec/dpx.c':69C 'make':89C 'media':19B 'media-process':18B 'next':52B,105C 'packag':21B 'pictur':74C 'privat':75C 'process':20B 'servic':66C 'slice':93C 'start':90C 'suppli':84C 'termin':54B,108C 'trigger':46B,98C 'via':7A 'vulkan':9A,22B,29B,78C 'vulner':67C","nicknames":[],"mitigations":[],"who_affected":"Systems that run FFmpeg 8.1 through 9.0.2 to decode DPX images, especially on Vulkan hardware acceleration, when they accept images from untrusted sources. The sources do not say whether the default build exercises this path. Teams that do not decode DPX files with FFmpeg can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ffmpeg","mediaprocessing","medium","package","vulkan"],"campaign_type":null,"search_a":"'-125237':13A,16A '-2026':12A,15A 'alloc':10A 'craft':2A 'crash':5A 'cve':11A,14A 'decod':6A 'dpx':3A 'ffmpeg':1A 'imag':4A 'leak':8A 'via':7A 'vulkan':9A","search_b":"'8.1':24B '9.0.2':26B 'abort':49B 'acceler':32B 'applic':57B 'assert':48B 'buffer':33B 'callback':40B 'craft':43B 'decod':38B,56B 'dpx':36B,44B 'fail':41B 'ffmpeg':17B,23B 'file':45B 'frame':53B 'hardwar':31B 'hardware-acceler':30B 'imag':37B 'leak':27B 'media':19B 'media-process':18B 'next':52B 'packag':21B 'process':20B 'termin':54B 'trigger':46B 'vulkan':22B,29B","search_c":"'8.1':59C '9.0.2':61C 'abort':102C 'alloc':76C 'applic':111C 'assert0':101C 'attack':82C 'av':100C 'callback':80C 'contain':62C 'craft':85C 'decod':92C,110C 'denial':64C 'dpx':72C,86C 'end':95C 'fail':81C,97C 'ffmpeg':58C 'frame':91C,96C,106C 'hwaccel':73C,79C 'imag':87C 'leav':71C 'libavcodec/dpx.c':69C 'make':89C 'next':105C 'pictur':74C 'privat':75C 'servic':66C 'slice':93C 'start':90C 'suppli':84C 'termin':108C 'trigger':98C 'vulkan':78C 'vulner':67C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T19:17:01+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125237","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125237","severity":null,"published_at":"2026-11-09T19:17:01+00:00","modified_at":"2026-11-09T19:17:01+00:00","first_seen_at":"2026-11-09T19:28:20+00:00","fetched_at":"2026-11-09T19:28:20+00:00","note":null}],"documents":[{"id":109365,"url":"https://www.vulncheck.com/advisories/ffmpeg-8.1-through-9.0.2-denial-of-service-via-dpx-vulkan-hwaccel-error-path","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}