FFMPEG · CVE-2026-125245 · Runtime
NO FIX YET
FFmpeg through 9.0.2 overwrites a hwaccel private data pointer in the MJPEG decoder without freeing it, so memory leaks. An attacker who supplies crafted MJPEG streams with repeated SOF markers or failing frames can leak hardware decoding private data and buffers under VAAPI or NVDEC.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Systems that run FFmpeg through 9.0.2 to decode untrusted MJPEG input, especially with VAAPI or NVDEC hardware acceleration. Services that only process trusted local media or do not decode MJPEG can likely skip it. The sources do not give further detail.
Not affected if no-hardware-decoding, no-untrusted-mjpeg-input
Who cares ffmpeg, media-processing, nvdec, vaapi
ffmpeg -version and compare it with the fixed release in the product ranges.No fix yet, per the sources.
FFmpeg through 9.0.2 contains a memory leak vulnerability in ff_mjpeg_decode_sof() in libavcodec/mjpegdec.c, which overwrites the hwaccel_picture_private pointer without freeing it. Attackers can supply crafted MJPEG streams with repeated SOF markers or failing frames to leak hwaccel private data and hardware buffers under VAAPI or NVDEC decoding.
This page as .md · .json · CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.