{"id":"CVE-2026-125242","kind":"vulnerability","aliases":["CVE-2026-125242"],"related":[],"title":"FFmpeg: crafted H.264 streams leak memory and exhaust heap","description":"FFmpeg through 9.0.2 contains a memory leak vulnerability in libavcodec/vdpau.c that allows attackers to exhaust heap memory by aborting pictures before end_frame. Attackers can supply crafted H.264 streams with malformed NAL units that repeatedly abandon pictures, leaking the bitstream_buffers table continuously and causing denial of service.","summary":"FFmpeg's VDPAU decoding code in libavcodec leaks a buffer table when a picture is aborted before end_frame. A crafted H.264 stream with malformed NAL units can repeatedly trigger this, exhausting heap memory and causing a denial of service.","severity":"medium","cvss":5.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ffmpeg","h264","libavcodec","runtime","self-hosted","vdpau"],"not_affected_if":["trusted-input-only","vdpau-not-used"],"how_to_check":"- Check the installed FFmpeg version with `ffmpeg -version` and compare it against the ranges in the NVD entry.\n- Check whether FFmpeg is built with VDPAU support (`ffmpeg -hwaccels` lists vdpau when it is enabled).","fix":null,"status":"open","published_at":"2026-11-09T19:17:02+00:00","first_seen_at":"2026-11-09T19:28:20+00:00","triaged_at":"2026-11-09T19:31:59+00:00","updated_at":"2026-11-09T19:31:59+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-09T19:31:59Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"FFmpeg: crafted H.264 streams leak memory and exhaust heap","impact":"low","summary":"FFmpeg's VDPAU decoding code in libavcodec leaks a buffer table when a picture is aborted before end_frame. A crafted H.264 stream with malformed NAL units can repeatedly trigger this, exhausting heap memory and causing a denial of service.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["ffmpeg","libavcodec","vdpau","h264","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker exhausts server heap memory, causing denial of service","analyst_note":"Confirm the fixed version from the linked github.com patch commits and the VulnCheck advisory; the sources here do not state it.","how_to_check":"- Check the installed FFmpeg version with `ffmpeg -version` and compare it against the ranges in the NVD entry.\n- Check whether FFmpeg is built with VDPAU support (`ffmpeg -hwaccels` lists vdpau when it is enabled).\n- unknown for anything beyond this, as the sources do not say.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["trusted-input-only","vdpau-not-used"],"who_is_affected":"Systems that decode untrusted H.264 video with FFmpeg and use the VDPAU hardware path are the ones exposed. Services that only process trusted media or do not use VDPAU can likely skip it. The sources do not give a fixed version.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000765,"input_tokens":4642,"output_tokens":601,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125242':12A,15A '-2026':11A,14A '9.0.2':66C 'abandon':99C 'abort':39B,82C 'allow':75C 'attack':76C,87C 'bitstream':103C 'buffer':33B,104C 'caus':59B,108C 'code':28B 'contain':67C 'continu':106C 'craft':2A,44B,90C 'cve':10A,13A 'decod':27B 'denial':61B,109C 'end':41B,85C 'exhaust':8A,55B,78C 'ffmpeg':1A,16B,24B,64C 'frame':42B,86C 'h.264':3A,45B,91C 'h264':17B 'heap':9A,56B,79C 'host':22B 'leak':5A,31B,70C,101C 'libavcodec':18B,30B 'libavcodec/vdpau.c':73C 'malform':48B,94C 'memori':6A,57B,69C,80C 'nal':49B,95C 'pictur':37B,83C,100C 'repeat':52B,98C 'runtim':19B 'self':21B 'self-host':20B 'servic':63B,111C 'stream':4A,46B,92C 'suppli':89C 'tabl':34B,105C 'trigger':53B 'unit':50B,96C 'vdpau':23B,26B 'vulner':71C","nicknames":[],"mitigations":[],"who_affected":"Systems that decode untrusted H.264 video with FFmpeg and use the VDPAU hardware path are the ones exposed. Services that only process trusted media or do not use VDPAU can likely skip it. The sources do not give a fixed version.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ffmpeg","h264","libavcodec","medium","runtime","selfhosted","vdpau"],"campaign_type":null,"search_a":"'-125242':12A,15A '-2026':11A,14A 'craft':2A 'cve':10A,13A 'exhaust':8A 'ffmpeg':1A 'h.264':3A 'heap':9A 'leak':5A 'memori':6A 'stream':4A","search_b":"'abort':39B 'buffer':33B 'caus':59B 'code':28B 'craft':44B 'decod':27B 'denial':61B 'end':41B 'exhaust':55B 'ffmpeg':16B,24B 'frame':42B 'h.264':45B 'h264':17B 'heap':56B 'host':22B 'leak':31B 'libavcodec':18B,30B 'malform':48B 'memori':57B 'nal':49B 'pictur':37B 'repeat':52B 'runtim':19B 'self':21B 'self-host':20B 'servic':63B 'stream':46B 'tabl':34B 'trigger':53B 'unit':50B 'vdpau':23B,26B","search_c":"'9.0.2':66C 'abandon':99C 'abort':82C 'allow':75C 'attack':76C,87C 'bitstream':103C 'buffer':104C 'caus':108C 'contain':67C 'continu':106C 'craft':90C 'denial':109C 'end':85C 'exhaust':78C 'ffmpeg':64C 'frame':86C 'h.264':91C 'heap':79C 'leak':70C,101C 'libavcodec/vdpau.c':73C 'malform':94C 'memori':69C,80C 'nal':95C 'pictur':83C,100C 'repeat':98C 'servic':111C 'stream':92C 'suppli':89C 'tabl':105C 'unit':96C 'vulner':71C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T19:17:02+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125242","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125242","severity":null,"published_at":"2026-11-09T19:17:02+00:00","modified_at":"2026-11-09T19:17:02+00:00","first_seen_at":"2026-11-09T19:28:20+00:00","fetched_at":"2026-11-09T19:28:20+00:00","note":null}],"documents":[{"id":109373,"url":"https://github.com/FFmpeg/FFmpeg/commit/2c6cd8098844f2367f8ba0a3a483e405c8f76449","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109374,"url":"https://github.com/FFmpeg/FFmpeg/commit/eac2bedcf6245552b39eed32b334851bc6a1b8fa","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109375,"url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-memory-leak-via-vdpau-hwaccel-bitstream-buffer-table","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}