{"id":"CVE-2026-125239","kind":"vulnerability","aliases":["CVE-2026-125239"],"related":[],"title":"FFmpeg: crafted HEVC video lets attackers corrupt memory on Windows","description":"FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in ff_dxva2_hevc_fill_picture_parameters() that allows attackers to corrupt memory via unbounded non-uniform tile counts. Attackers can supply crafted HEVC bitstreams with many non-uniformly spaced tiles to write controlled 16-bit values past fixed-size DXVA arrays during DXVA2, D3D11VA, or D3D12VA decoding on Windows.","summary":"FFmpeg through 9.0.2 has a heap buffer overflow in its DXVA2, D3D11VA and D3D12VA HEVC decoding code on Windows. A crafted HEVC bitstream with many non-uniformly spaced tiles writes controlled 16-bit values past fixed-size arrays, corrupting memory.","severity":"high","cvss":7.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ffmpeg","fixed":[],"affected":"<= 9.0.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["ffmpeg","hevc","media-processing","package","windows"],"not_affected_if":["no-hevc-decoding","non-windows","software-decoding-only"],"how_to_check":"- Run `ffmpeg -version`; versions 9.0.2 and earlier are affected (no fixed release yet).\n- Only Windows builds using DXVA2, D3D11VA or D3D12VA hardware HEVC decoding are affected (libavcodec/dxva2_hevc.c).\n- Also check apps that embed FFmpeg/libavcodec on Windows and decode untrusted HEVC with hwaccel enabled.\n- Workaround (not from the advisory, which lists none): force software HEVC decoding, e.g. don't pass -hwaccel dxva2/d3d11va/d3d12va.","fix":"No released fix yet. Candidate fix is open FFmpeg PR 25136 (milestone 'FFmpeg 9.1 branching'), not merged as of 2026-11-09. Until then, build from master after it merges or disable DXVA2/D3D11VA/D3D12VA HEVC hwaccel.","status":"open","published_at":"2026-11-09T19:17:02+00:00","first_seen_at":"2026-11-09T19:28:20+00:00","triaged_at":"2026-11-09T19:29:54+00:00","updated_at":"2026-11-09T19:31:44+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-09T19:29:54Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"FFmpeg: crafted HEVC video lets attackers corrupt memory on Windows","impact":"high","summary":"FFmpeg through 9.0.2 has a heap buffer overflow in its DXVA2, D3D11VA and D3D12VA HEVC decoding code on Windows. A crafted HEVC bitstream with many non-uniformly spaced tiles writes controlled 16-bit values past fixed-size arrays, corrupting memory.","audience":"developers","category":"package","nicknames":[],"who_cares":["ffmpeg","windows","hevc","media-processing"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"attacker writes controlled values into memory, possibly running code","analyst_note":"Confirm the fixed FFmpeg version and the affected hardware decode paths from the NVD entry and the vulncheck advisory.","how_to_check":"- Check the installed FFmpeg version with `ffmpeg -version` and compare it against the fixed release.\n- Check whether the build uses hardware HEVC decoding through DXVA2, D3D11VA or D3D12VA on Windows.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["non-windows","no-hevc-decoding","software-decoding-only"],"who_is_affected":"Systems on Windows that decode HEVC video with FFmpeg's DXVA2, D3D11VA or D3D12VA hardware paths are exposed when they process untrusted media. Software that only uses FFmpeg on Linux or macOS, or that never decodes HEVC, is unlikely to be affected. unknown beyond that.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000785,"input_tokens":4658,"output_tokens":638,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed FFmpeg version and the affected hardware decode paths from the NVD entry and the vulncheck advisory.","search":"'-125239':13A,16A '-2026':12A,15A '16':57B,112C '9.0.2':27B,69C 'allow':84C 'array':64B,120C 'attack':6A,85C,96C 'bit':58B,113C 'bitstream':47B,101C 'buffer':31B,73C 'code':41B 'contain':70C 'control':56B,111C 'corrupt':7A,65B,87C 'count':95C 'craft':2A,45B,99C 'cve':11A,14A 'd3d11va':36B,123C 'd3d12va':38B,125C 'decod':40B,126C 'dxva':119C 'dxva2':35B,78C,122C 'ff':77C 'ffmpeg':1A,17A,18B,25B,67C 'fill':80C 'fix':62B,117C 'fixed-s':61B,116C 'heap':30B,72C 'hevc':3A,19B,39B,46B,79C,100C 'let':5A 'mani':49B,103C 'media':21B 'media-process':20B 'memori':8A,66B,88C 'non':51B,92C,105C 'non-uniform':50B,91C,104C 'overflow':32B,74C 'packag':23B 'paramet':82C 'past':60B,115C 'pictur':81C 'process':22B 'size':63B,118C 'space':53B,107C 'suppli':98C 'tile':54B,94C,108C 'unbound':90C 'uniform':52B,93C,106C 'valu':59B,114C 'via':89C 'video':4A 'vulner':75C 'window':10A,24B,43B,128C 'write':55B,110C","nicknames":[],"mitigations":[],"who_affected":"Systems on Windows that decode HEVC video with FFmpeg's DXVA2, D3D11VA or D3D12VA hardware paths are exposed when they process untrusted media. Software that only uses FFmpeg on Linux or macOS, or that never decodes HEVC, is unlikely to be affected. unknown beyond that.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":["ffmpeg"],"ptokens":["ffmpeg"],"labels":["ffmpeg","hevc","high","mediaprocessing","package","windows"],"campaign_type":null,"search_a":"'-125239':13A,16A '-2026':12A,15A 'attack':6A 'corrupt':7A 'craft':2A 'cve':11A,14A 'ffmpeg':1A,17A 'hevc':3A 'let':5A 'memori':8A 'video':4A 'window':10A","search_b":"'16':57B '9.0.2':27B 'array':64B 'bit':58B 'bitstream':47B 'buffer':31B 'code':41B 'control':56B 'corrupt':65B 'craft':45B 'd3d11va':36B 'd3d12va':38B 'decod':40B 'dxva2':35B 'ffmpeg':18B,25B 'fix':62B 'fixed-s':61B 'heap':30B 'hevc':19B,39B,46B 'mani':49B 'media':21B 'media-process':20B 'memori':66B 'non':51B 'non-uniform':50B 'overflow':32B 'packag':23B 'past':60B 'process':22B 'size':63B 'space':53B 'tile':54B 'uniform':52B 'valu':59B 'window':24B,43B 'write':55B","search_c":"'16':112C '9.0.2':69C 'allow':84C 'array':120C 'attack':85C,96C 'bit':113C 'bitstream':101C 'buffer':73C 'contain':70C 'control':111C 'corrupt':87C 'count':95C 'craft':99C 'd3d11va':123C 'd3d12va':125C 'decod':126C 'dxva':119C 'dxva2':78C,122C 'ff':77C 'ffmpeg':67C 'fill':80C 'fix':117C 'fixed-s':116C 'heap':72C 'hevc':79C,100C 'mani':103C 'memori':88C 'non':92C,105C 'non-uniform':91C,104C 'overflow':74C 'paramet':82C 'past':115C 'pictur':81C 'size':118C 'space':107C 'suppli':98C 'tile':94C,108C 'unbound':90C 'uniform':93C,106C 'valu':114C 'via':89C 'vulner':75C 'window':128C 'write':110C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T19:17:02+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125239","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125239","severity":null,"published_at":"2026-11-09T19:17:02+00:00","modified_at":"2026-11-09T19:17:02+00:00","first_seen_at":"2026-11-09T19:28:20+00:00","fetched_at":"2026-11-09T19:28:20+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-125239:2322","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25136","severity":null,"published_at":"2026-11-09T19:31:44+00:00","modified_at":"2026-11-09T19:31:44+00:00","first_seen_at":"2026-11-09T19:31:44+00:00","fetched_at":"2026-11-09T19:31:44+00:00","note":"VulnCheck advisory read: affects <=9.0.2, credit J. Rogers/AISLE & M. Niedermayer, no fixed release named. Linked PR 25136 is open/unmerged, target milestone 9.1. NVD page unreadable via fetch. Search tools unavailable (web-cli missing), no discussion check. Nothing marked verified: no fix exists in a primary release.","cites":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25136"]}],"documents":[{"id":109368,"url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-heap-buffer-overflow-via-hevc-dxva-tile-parameters","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"},{"id":109481,"url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25136","title":"FFmpeg PR 25136: libavcodec fixes (HEVC/AV1 hwaccel tile arrays, Vulkan) - open","kind":"issue","source":"analyst","publisher":null,"text":"Open PR into master, milestone FFmpeg 9.1 branching, 0/1 approvals. Commit 21017c72db: vdpau_hevc rejects tile counts the VDPAU picture info cannot hold. Also vaapi, dxva2, vulkan HEVC tile-count checks. Each commit message cites a security report from AISLE.","published_at":null,"relation":"fix","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}