{"id":"CVE-2026-125245","kind":"vulnerability","aliases":["CVE-2026-125245"],"related":[],"title":"FFmpeg: crafted MJPEG streams leak memory during hardware decoding","description":"FFmpeg through 9.0.2 contains a memory leak vulnerability in ff_mjpeg_decode_sof() in libavcodec/mjpegdec.c, which overwrites the hwaccel_picture_private pointer without freeing it. Attackers can supply crafted MJPEG streams with repeated SOF markers or failing frames to leak hwaccel private data and hardware buffers under VAAPI or NVDEC decoding.","summary":"FFmpeg through 9.0.2 overwrites a hwaccel private data pointer in the MJPEG decoder without freeing it, so memory leaks. An attacker who supplies crafted MJPEG streams with repeated SOF markers or failing frames can leak hardware decoding private data and buffers under VAAPI or NVDEC.","severity":"medium","cvss":5.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"FFmpeg","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["ffmpeg","media-processing","nvdec","runtime","vaapi"],"not_affected_if":["no-hardware-decoding","no-untrusted-mjpeg-input"],"how_to_check":"- Check the installed FFmpeg version with `ffmpeg -version` and compare it with the fixed release in the product ranges.\n- Confirm whether hardware decoding through VAAPI or NVDEC is enabled in your pipeline.","fix":null,"status":"open","published_at":"2026-11-09T19:17:03+00:00","first_seen_at":"2026-11-09T19:28:21+00:00","triaged_at":"2026-11-09T19:31:57+00:00","updated_at":"2026-11-09T19:31:57+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-09T19:31:57Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"FFmpeg: crafted MJPEG streams leak memory during hardware decoding","impact":"low","summary":"FFmpeg through 9.0.2 overwrites a hwaccel private data pointer in the MJPEG decoder without freeing it, so memory leaks. An attacker who supplies crafted MJPEG streams with repeated SOF markers or failing frames can leak hardware decoding private data and buffers under VAAPI or NVDEC.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["ffmpeg","media-processing","vaapi","nvdec"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"memory leaks and hardware buffer data exposure on decoding servers","analyst_note":"Find the fixed FFmpeg version and confirm the affected scope via the linked patch at github.com and the VulnCheck advisory.","how_to_check":"- Check the installed FFmpeg version with `ffmpeg -version` and compare it with the fixed release in the product ranges.\n- Confirm whether hardware decoding through VAAPI or NVDEC is enabled in your pipeline.\n- unknown for anything beyond this, as the sources do not say.","plain_action":"","product_name":"FFmpeg","needs_analyst":true,"not_affected_if":["no-untrusted-mjpeg-input","no-hardware-decoding"],"who_is_affected":"Systems that run FFmpeg through 9.0.2 to decode untrusted MJPEG input, especially with VAAPI or NVDEC hardware acceleration. Services that only process trusted local media or do not decode MJPEG can likely skip it. The sources do not give further detail.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000795,"input_tokens":4657,"output_tokens":658,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125245':12A,15A '-2026':11A,14A '9.0.2':26B,71C 'attack':44B,94C 'buffer':64B,114C 'contain':72C 'craft':2A,47B,97C 'cve':10A,13A 'data':31B,62B,111C 'decod':9A,36B,60B,80C,119C 'fail':55B,105C 'ff':78C 'ffmpeg':1A,16A,17B,24B,69C 'frame':56B,106C 'free':38B,92C 'hardwar':8A,59B,113C 'hwaccel':29B,87C,109C 'leak':5A,42B,58B,75C,108C 'libavcodec/mjpegdec.c':83C 'marker':53B,103C 'media':19B 'media-process':18B 'memori':6A,41B,74C 'mjpeg':3A,35B,48B,79C,98C 'nvdec':21B,68B,118C 'overwrit':27B,85C 'pictur':88C 'pointer':32B,90C 'privat':30B,61B,89C,110C 'process':20B 'repeat':51B,101C 'runtim':22B 'sof':52B,81C,102C 'stream':4A,49B,99C 'suppli':46B,96C 'vaapi':23B,66B,116C 'vulner':76C 'without':37B,91C","nicknames":[],"mitigations":[],"who_affected":"Systems that run FFmpeg through 9.0.2 to decode untrusted MJPEG input, especially with VAAPI or NVDEC hardware acceleration. Services that only process trusted local media or do not decode MJPEG can likely skip it. The sources do not give further detail.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["ffmpeg"],"ptokens":["ffmpeg"],"labels":["ffmpeg","mediaprocessing","medium","nvdec","runtime","vaapi","vendor"],"campaign_type":null,"search_a":"'-125245':12A,15A '-2026':11A,14A 'craft':2A 'cve':10A,13A 'decod':9A 'ffmpeg':1A,16A 'hardwar':8A 'leak':5A 'memori':6A 'mjpeg':3A 'stream':4A","search_b":"'9.0.2':26B 'attack':44B 'buffer':64B 'craft':47B 'data':31B,62B 'decod':36B,60B 'fail':55B 'ffmpeg':17B,24B 'frame':56B 'free':38B 'hardwar':59B 'hwaccel':29B 'leak':42B,58B 'marker':53B 'media':19B 'media-process':18B 'memori':41B 'mjpeg':35B,48B 'nvdec':21B,68B 'overwrit':27B 'pointer':32B 'privat':30B,61B 'process':20B 'repeat':51B 'runtim':22B 'sof':52B 'stream':49B 'suppli':46B 'vaapi':23B,66B 'without':37B","search_c":"'9.0.2':71C 'attack':94C 'buffer':114C 'contain':72C 'craft':97C 'data':111C 'decod':80C,119C 'fail':105C 'ff':78C 'ffmpeg':69C 'frame':106C 'free':92C 'hardwar':113C 'hwaccel':87C,109C 'leak':75C,108C 'libavcodec/mjpegdec.c':83C 'marker':103C 'memori':74C 'mjpeg':79C,98C 'nvdec':118C 'overwrit':85C 'pictur':88C 'pointer':90C 'privat':89C,110C 'repeat':101C 'sof':81C,102C 'stream':99C 'suppli':96C 'vaapi':116C 'vulner':76C 'without':91C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T19:17:03+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125245","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125245","severity":null,"published_at":"2026-11-09T19:17:03+00:00","modified_at":"2026-11-09T19:17:03+00:00","first_seen_at":"2026-11-09T19:28:21+00:00","fetched_at":"2026-11-09T19:28:21+00:00","note":null}],"documents":[{"id":109380,"url":"https://github.com/FFmpeg/FFmpeg/commit/50e9ef29be1766404115b0a4908fa3fd6ed7fa3f","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109381,"url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-memory-leak-in-mjpeg-hwaccel-sof-decoding","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}