CVE-2026-125252 · Runtime
NO FIX YET · SEE WHAT TO DO
FFmpeg through 9.0.2 leaks VA parameter and slice buffers in its VAAPI hardware decoder when later slices of a stream fail to parse. An attacker who supplies crafted H.264 or other VAAPI-decoded video can exhaust the memory of the process decoding it.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Systems that run FFmpeg's VAAPI hardware decoder on video from untrusted sources, such as media transcoding services or upload pipelines, are exposed. Desktop use on trusted local files, or builds without VAAPI decoding, are unlikely to be affected.
Not affected if no-vaapi-decoding, trusted-input-only
Who cares ffmpeg, media-processing, self-hosted, vaapi
ffmpeg -version and compare it with the fixed releases.-hwaccel vaapi) or through a library that calls libavcodec.9.0.2; the patch commits are linked from the sources, but the sources do not name the exact fixed release.FFmpeg through 9.0.2 contains a memory leak vulnerability in libavcodec/vaapi_decode.c that allows attackers to exhaust memory by supplying streams with slice parse errors. Attackers can craft H.264 or other VAAPI-decoded video where later slices fail to parse on every frame, continuously leaking VA parameter and slice buffers plus driver and heap memory.
This page as .md · .json · CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.