{"id":"CVE-2026-125252","kind":"vulnerability","aliases":["CVE-2026-125252"],"related":[],"title":"FFmpeg: crafted video with slice parse errors leaks memory until exhausted","description":"FFmpeg through 9.0.2 contains a memory leak vulnerability in libavcodec/vaapi_decode.c that allows attackers to exhaust memory by supplying streams with slice parse errors. Attackers can craft H.264 or other VAAPI-decoded video where later slices fail to parse on every frame, continuously leaking VA parameter and slice buffers plus driver and heap memory.","summary":"FFmpeg through 9.0.2 leaks VA parameter and slice buffers in its VAAPI hardware decoder when later slices of a stream fail to parse. An attacker who supplies crafted H.264 or other VAAPI-decoded video can exhaust the memory of the process decoding it.","severity":"medium","cvss":5.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ffmpeg","media-processing","runtime","self-hosted","vaapi"],"not_affected_if":["no-vaapi-decoding","trusted-input-only"],"how_to_check":"- Check the installed FFmpeg version with `ffmpeg -version` and compare it with the fixed releases.\n- Check whether FFmpeg decodes untrusted video through VAAPI hardware acceleration (`-hwaccel vaapi`) or through a library that calls libavcodec.","fix":"- FFmpeg: move past `9.0.2`; the patch commits are linked from the sources, but the sources do not name the exact fixed release.","status":"open","published_at":"2026-11-09T20:18:11+00:00","first_seen_at":"2026-11-09T20:48:13+00:00","triaged_at":"2026-11-09T20:49:57+00:00","updated_at":"2026-11-09T20:49:57+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-09T20:49:57Z","model":"claude-haiku-5-5","output":{"fix":"- FFmpeg: move past `9.0.2`; the patch commits are linked from the sources, but the sources do not name the exact fixed release.","reach":"internet","title":"FFmpeg: crafted video with slice parse errors leaks memory until exhausted","impact":"low","summary":"FFmpeg through 9.0.2 leaks VA parameter and slice buffers in its VAAPI hardware decoder when later slices of a stream fail to parse. An attacker who supplies crafted H.264 or other VAAPI-decoded video can exhaust the memory of the process decoding it.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["ffmpeg","vaapi","media-processing","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Decoding process runs out of memory and crashes or stalls the host","analyst_note":"Confirm the exact fixed FFmpeg release from the linked patch commits and the vulncheck advisory, since the sources only say 'through 9.0.2'.","how_to_check":"- Check the installed FFmpeg version with `ffmpeg -version` and compare it with the fixed releases.\n- Check whether FFmpeg decodes untrusted video through VAAPI hardware acceleration (`-hwaccel vaapi`) or through a library that calls libavcodec.\n- unknown for anything beyond this, since the sources do not give further detection steps.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-vaapi-decoding","trusted-input-only"],"who_is_affected":"Systems that run FFmpeg's VAAPI hardware decoder on video from untrusted sources, such as media transcoding services or upload pipelines, are exposed. Desktop use on trusted local files, or builds without VAAPI decoding, are unlikely to be affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000806,"input_tokens":4646,"output_tokens":682,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125252':14A,17A '-2026':13A,16A '9.0.2':29B,72C 'allow':81C 'attack':51B,82C,93C 'buffer':35B,118C 'contain':73C 'continu':112C 'craft':2A,54B,95C 'cve':12A,15A 'decod':40B,60B,69B,101C 'driver':120C 'error':7A,92C 'everi':110C 'exhaust':11A,63B,84C 'fail':47B,106C 'ffmpeg':1A,18B,27B,70C 'frame':111C 'h.264':55B,96C 'hardwar':39B 'heap':122C 'host':25B 'later':42B,104C 'leak':8A,30B,76C,113C 'libavcodec/vaapi_decode.c':79C 'media':20B 'media-process':19B 'memori':9A,65B,75C,85C,123C 'paramet':32B,115C 'pars':6A,49B,91C,108C 'plus':119C 'process':21B,68B 'runtim':22B 'self':24B 'self-host':23B 'slice':5A,34B,43B,90C,105C,117C 'stream':46B,88C 'suppli':53B,87C 'va':31B,114C 'vaapi':26B,38B,59B,100C 'vaapi-decod':58B,99C 'video':3A,61B,102C 'vulner':77C","nicknames":[],"mitigations":[],"who_affected":"Systems that run FFmpeg's VAAPI hardware decoder on video from untrusted sources, such as media transcoding services or upload pipelines, are exposed. Desktop use on trusted local files, or builds without VAAPI decoding, are unlikely to be affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ffmpeg","mediaprocessing","medium","runtime","selfhosted","vaapi"],"campaign_type":null,"search_a":"'-125252':14A,17A '-2026':13A,16A 'craft':2A 'cve':12A,15A 'error':7A 'exhaust':11A 'ffmpeg':1A 'leak':8A 'memori':9A 'pars':6A 'slice':5A 'video':3A","search_b":"'9.0.2':29B 'attack':51B 'buffer':35B 'craft':54B 'decod':40B,60B,69B 'exhaust':63B 'fail':47B 'ffmpeg':18B,27B 'h.264':55B 'hardwar':39B 'host':25B 'later':42B 'leak':30B 'media':20B 'media-process':19B 'memori':65B 'paramet':32B 'pars':49B 'process':21B,68B 'runtim':22B 'self':24B 'self-host':23B 'slice':34B,43B 'stream':46B 'suppli':53B 'va':31B 'vaapi':26B,38B,59B 'vaapi-decod':58B 'video':61B","search_c":"'9.0.2':72C 'allow':81C 'attack':82C,93C 'buffer':118C 'contain':73C 'continu':112C 'craft':95C 'decod':101C 'driver':120C 'error':92C 'everi':110C 'exhaust':84C 'fail':106C 'ffmpeg':70C 'frame':111C 'h.264':96C 'heap':122C 'later':104C 'leak':76C,113C 'libavcodec/vaapi_decode.c':79C 'memori':75C,85C,123C 'paramet':115C 'pars':91C,108C 'plus':119C 'slice':90C,105C,117C 'stream':88C 'suppli':87C 'va':114C 'vaapi':100C 'vaapi-decod':99C 'video':102C 'vulner':77C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T20:18:11+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125252","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125252","severity":null,"published_at":"2026-11-09T20:18:11+00:00","modified_at":"2026-11-09T20:18:11+00:00","first_seen_at":"2026-11-09T20:48:13+00:00","fetched_at":"2026-11-09T20:48:13+00:00","note":null}],"documents":[{"id":109714,"url":"https://github.com/FFmpeg/FFmpeg/commit/4221a63ce869ade862557ca64693bf77f5032971","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109715,"url":"https://github.com/FFmpeg/FFmpeg/commit/838c660bb3cd66ba74981b453c14c79214f6ef92","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109716,"url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-vaapi-memory-leak-via-abandoned-picture-buffers","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}