CVE-2026-125255 · Package
NO FIX YET
FFmpeg's MJPEG decoder in libavcodec can read a freed buffer when a stream sends a start-of-frame marker without a preceding start-of-image marker. A crafted MJPEG file or stream can crash the application or leak heap memory contents.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications that decode untrusted MJPEG input with FFmpeg's libavcodec, especially with hardware decoding such as NVDEC, are the ones exposed. Systems that only process trusted media, or do not decode MJPEG from outside sources, are less exposed. The sources do not state a fixed version.
Not affected if no-mjpeg-decoding, trusted-input-only
Who cares ffmpeg, libavcodec, media-processing, mjpeg
ffmpeg -version; the sources say versions through 9.0.2 are affected.No fix yet, per the sources.
FFmpeg through 9.0.2 contains a use after free vulnerability in libavcodec/mjpegdec.c that allows attackers to trigger freed buffer reads by sending a SOF marker without a preceding SOI. Attackers can supply crafted MJPEG streams causing ff_mjpeg_decode_sof() to pass a stale raw_image_buffer pointer to hwaccel decoders like NVDEC, crashing applications or leaking heap contents.
This page as .md · .json · CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.