CVE-2026-125265 · Package
NO FIX YET · SEE WHAT TO DO
FFmpeg through 9.0.2 fails to reset a bitstream pointer in its NVDEC hardware decoder after slice errors, so a crafted video can make it read freed heap memory. An attacker gets application crashes or leaks stale heap contents.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Systems that decode untrusted video with FFmpeg's NVDEC hardware path (libavcodec/nvdec.c) are exposed, since a crafted file is the trigger. Services that only process trusted or internally produced media, or that do not use NVDEC, are less exposed. The sources do not say which distributions or builds ship the patch.
Not affected if no-nvdec, trusted-input-only
Who cares ffmpeg, media-processing, nvdec, self-hosted
ffmpeg -version-hwaccel nvdec or cuvid decoders) in your pipeline9.0.2; the sources do not name the exact fixed versionFFmpeg through 9.0.2 contains a use-after-free vulnerability in libavcodec/nvdec.c because ff_nvdec_start_frame() fails to reset ctx->bitstream after slice errors. Attackers can supply crafted video that abandons a picture before end_frame, causing cuvidDecodePicture() to read freed heap memory, crashing applications or exposing stale heap contents.
This page as .md · .json · CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.