---
id: "CVE-2026-125245"
page: "https://infrastack.ai/live/CVE-2026-125245"
kind: "vulnerability"
aliases: ["CVE-2026-125245"]
title: "FFmpeg: crafted MJPEG streams leak memory during hardware decoding"
severity: "medium"
cvss: 5.7
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "FFmpeg", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["ffmpeg", "media-processing", "nvdec", "runtime", "vaapi"]
not_affected_if: ["no-hardware-decoding", "no-untrusted-mjpeg-input"]
published_at: "2026-11-09T19:17:03+00:00"
first_seen_at: "2026-11-09T19:28:21+00:00"
updated_at: "2026-11-09T19:31:57+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-125245", "first_seen_at": "2026-11-09T19:28:21+00:00"}]
exploit_sources: []
---

# FFmpeg: crafted MJPEG streams leak memory during hardware decoding

Link for people: https://infrastack.ai/live/CVE-2026-125245 (this .md is for agents)

FFmpeg through 9.0.2 overwrites a hwaccel private data pointer in the MJPEG decoder without freeing it, so memory leaks. An attacker who supplies crafted MJPEG streams with repeated SOF markers or failing frames can leak hardware decoding private data and buffers under VAAPI or NVDEC.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:FFmpeg affected range not listed fixed no fixed version listed

## How to check

- Check the installed FFmpeg version with `ffmpeg -version` and compare it with the fixed release in the product ranges.
- Confirm whether hardware decoding through VAAPI or NVDEC is enabled in your pipeline.

## Timeline

- 2026-11-09T19:28:21+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-125245

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-memory-leak-in-mjpeg-hwaccel-sof-decoding
- [fix] Patch: github.com https://github.com/FFmpeg/FFmpeg/commit/50e9ef29be1766404115b0a4908fa3fd6ed7fa3f

## From the sources

FFmpeg through 9.0.2 contains a memory leak vulnerability in ff_mjpeg_decode_sof() in libavcodec/mjpegdec.c, which overwrites the hwaccel_picture_private pointer without freeing it. Attackers can supply crafted MJPEG streams with repeated SOF markers or failing frames to leak hwaccel private data and hardware buffers under VAAPI or NVDEC decoding.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_