{"id":"CVE-2026-125255","kind":"vulnerability","aliases":["CVE-2026-125255"],"related":[],"title":"FFmpeg: crafted MJPEG stream triggers use-after-free and heap leak","description":"FFmpeg through 9.0.2 contains a use after free vulnerability in libavcodec/mjpegdec.c that allows attackers to trigger freed buffer reads by sending a SOF marker without a preceding SOI. Attackers can supply crafted MJPEG streams causing ff_mjpeg_decode_sof() to pass a stale raw_image_buffer pointer to hwaccel decoders like NVDEC, crashing applications or leaking heap contents.","summary":"FFmpeg's MJPEG decoder in libavcodec can read a freed buffer when a stream sends a start-of-frame marker without a preceding start-of-image marker. A crafted MJPEG file or stream can crash the application or leak heap memory contents.","severity":"medium","cvss":5.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ffmpeg","libavcodec","media-processing","mjpeg","package"],"not_affected_if":["no-mjpeg-decoding","trusted-input-only"],"how_to_check":"- Check the FFmpeg version with `ffmpeg -version`; the sources say versions through 9.0.2 are affected.\n- Find where FFmpeg or libavcodec is embedded in your applications, including bundled builds, and check their versions.","fix":null,"status":"open","published_at":"2026-11-09T20:18:11+00:00","first_seen_at":"2026-11-09T20:48:13+00:00","triaged_at":"2026-11-09T20:49:52+00:00","updated_at":"2026-11-09T20:49:52+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-09T20:49:52Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"FFmpeg: crafted MJPEG stream triggers use-after-free and heap leak","impact":"medium","summary":"FFmpeg's MJPEG decoder in libavcodec can read a freed buffer when a stream sends a start-of-frame marker without a preceding start-of-image marker. A crafted MJPEG file or stream can crash the application or leak heap memory contents.","audience":"developers","category":"package","nicknames":[],"who_cares":["ffmpeg","libavcodec","mjpeg","media-processing"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker crashes the application or reads heap memory contents","analyst_note":"Check the linked patch on github.com and the VulnCheck advisory for the fixed FFmpeg version and whether hwaccel is required to trigger it.","how_to_check":"- Check the FFmpeg version with `ffmpeg -version`; the sources say versions through 9.0.2 are affected.\n- Find where FFmpeg or libavcodec is embedded in your applications, including bundled builds, and check their versions.\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["trusted-input-only","no-mjpeg-decoding"],"who_is_affected":"Applications that decode untrusted MJPEG input with FFmpeg's libavcodec, especially with hardware decoding such as NVDEC, are the ones exposed. Systems that only process trusted media, or do not decode MJPEG from outside sources, are less exposed. The sources do not state a fixed version.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000766,"input_tokens":4654,"output_tokens":602,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125255':15A,18A '-2026':14A,17A '9.0.2':72C 'allow':82C 'applic':64B,123C 'attack':83C,98C 'buffer':36B,87C,115C 'caus':104C 'contain':73C 'content':69B,127C 'craft':2A,56B,101C 'crash':62B,122C 'cve':13A,16A 'decod':29B,107C,119C 'ff':105C 'ffmpeg':1A,19B,26B,70C 'file':58B 'frame':45B 'free':9A,77C 'freed':35B,86C 'heap':11A,67B,126C 'hwaccel':118C 'imag':53B,114C 'leak':12A,66B,125C 'libavcodec':20B,31B 'libavcodec/mjpegdec.c':80C 'like':120C 'marker':46B,54B,93C 'media':22B 'media-process':21B 'memori':68B 'mjpeg':3A,24B,28B,57B,102C,106C 'nvdec':121C 'packag':25B 'pass':110C 'pointer':116C 'preced':49B,96C 'process':23B 'raw':113C 'read':33B,88C 'send':40B,90C 'sof':92C,108C 'soi':97C 'stale':112C 'start':43B,51B 'start-of-fram':42B 'start-of-imag':50B 'stream':4A,39B,60B,103C 'suppli':100C 'trigger':5A,85C 'use':7A,75C 'use-after-fre':6A 'vulner':78C 'without':47B,94C","nicknames":[],"mitigations":[],"who_affected":"Applications that decode untrusted MJPEG input with FFmpeg's libavcodec, especially with hardware decoding such as NVDEC, are the ones exposed. Systems that only process trusted media, or do not decode MJPEG from outside sources, are less exposed. The sources do not state a fixed version.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ffmpeg","libavcodec","mediaprocessing","medium","mjpeg","package"],"campaign_type":null,"search_a":"'-125255':15A,18A '-2026':14A,17A 'craft':2A 'cve':13A,16A 'ffmpeg':1A 'free':9A 'heap':11A 'leak':12A 'mjpeg':3A 'stream':4A 'trigger':5A 'use':7A 'use-after-fre':6A","search_b":"'applic':64B 'buffer':36B 'content':69B 'craft':56B 'crash':62B 'decod':29B 'ffmpeg':19B,26B 'file':58B 'frame':45B 'freed':35B 'heap':67B 'imag':53B 'leak':66B 'libavcodec':20B,31B 'marker':46B,54B 'media':22B 'media-process':21B 'memori':68B 'mjpeg':24B,28B,57B 'packag':25B 'preced':49B 'process':23B 'read':33B 'send':40B 'start':43B,51B 'start-of-fram':42B 'start-of-imag':50B 'stream':39B,60B 'without':47B","search_c":"'9.0.2':72C 'allow':82C 'applic':123C 'attack':83C,98C 'buffer':87C,115C 'caus':104C 'contain':73C 'content':127C 'craft':101C 'crash':122C 'decod':107C,119C 'ff':105C 'ffmpeg':70C 'free':77C 'freed':86C 'heap':126C 'hwaccel':118C 'imag':114C 'leak':125C 'libavcodec/mjpegdec.c':80C 'like':120C 'marker':93C 'mjpeg':102C,106C 'nvdec':121C 'pass':110C 'pointer':116C 'preced':96C 'raw':113C 'read':88C 'send':90C 'sof':92C,108C 'soi':97C 'stale':112C 'stream':103C 'suppli':100C 'trigger':85C 'use':75C 'vulner':78C 'without':94C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T20:18:11+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125255","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125255","severity":null,"published_at":"2026-11-09T20:18:11+00:00","modified_at":"2026-11-09T20:18:11+00:00","first_seen_at":"2026-11-09T20:48:13+00:00","fetched_at":"2026-11-09T20:48:13+00:00","note":null}],"documents":[{"id":109721,"url":"https://github.com/FFmpeg/FFmpeg/commit/f58a6776546567367baf5223df9ffbfd289299f8","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109722,"url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-use-after-free-in-mjpeg-hardware-accelerated-decoding","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}