FFMPEG · CVE-2026-125239 · Package
NO FIX YET · SEE WHAT TO DO
FFmpeg through 9.0.2 has a heap buffer overflow in its DXVA2, D3D11VA and D3D12VA HEVC decoding code on Windows. A crafted HEVC bitstream with many non-uniformly spaced tiles writes controlled 16-bit values past fixed-size arrays, corrupting memory.
first public Nov 9, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Systems on Windows that decode HEVC video with FFmpeg's DXVA2, D3D11VA or D3D12VA hardware paths are exposed when they process untrusted media. Software that only uses FFmpeg on Linux or macOS, or that never decodes HEVC, is unlikely to be affected. unknown beyond that.
Not affected if no-hevc-decoding, non-windows, software-decoding-only
Who cares ffmpeg, hevc, media-processing, windows
ffmpeg -version; versions 9.0.2 and earlier are affected (no fixed release yet).FFmpeg 9.1 branching), not merged as of 2026-11-09FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in ff_dxva2_hevc_fill_picture_parameters() that allows attackers to corrupt memory via unbounded non-uniform tile counts. Attackers can supply crafted HEVC bitstreams with many non-uniformly spaced tiles to write controlled 16-bit values past fixed-size DXVA arrays during DXVA2, D3D11VA, or D3D12VA decoding on Windows.
This page as .md · .json · CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.