{"id":"CVE-2026-125265","kind":"vulnerability","aliases":["CVE-2026-125265"],"related":[],"title":"FFmpeg: crafted video triggers use-after-free in NVDEC decoding","description":"FFmpeg through 9.0.2 contains a use-after-free vulnerability in libavcodec/nvdec.c because ff_nvdec_start_frame() fails to reset ctx->bitstream after slice errors. Attackers can supply crafted video that abandons a picture before end_frame, causing cuvidDecodePicture() to read freed heap memory, crashing applications or exposing stale heap contents.","summary":"FFmpeg through 9.0.2 fails to reset a bitstream pointer in its NVDEC hardware decoder after slice errors, so a crafted video can make it read freed heap memory. An attacker gets application crashes or leaks stale heap contents.","severity":"medium","cvss":5.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ffmpeg","media-processing","nvdec","package","self-hosted"],"not_affected_if":["no-nvdec","trusted-input-only"],"how_to_check":"- Check the installed FFmpeg version with `ffmpeg -version`\n- Check whether the build uses NVDEC hardware decoding (`-hwaccel nvdec` or `cuvid` decoders) in your pipeline","fix":"- Move to a FFmpeg release newer than `9.0.2`; the sources do not name the exact fixed version","status":"open","published_at":"2026-11-09T20:18:13+00:00","first_seen_at":"2026-11-09T20:48:14+00:00","triaged_at":"2026-11-09T20:49:52+00:00","updated_at":"2026-11-09T20:49:52+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-09T20:49:52Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a FFmpeg release newer than `9.0.2`; the sources do not name the exact fixed version","reach":"unknown","title":"FFmpeg: crafted video triggers use-after-free in NVDEC decoding","impact":"low","summary":"FFmpeg through 9.0.2 fails to reset a bitstream pointer in its NVDEC hardware decoder after slice errors, so a crafted video can make it read freed heap memory. An attacker gets application crashes or leaks stale heap contents.","audience":"businesses","category":"package","nicknames":[],"who_cares":["ffmpeg","nvdec","media-processing","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Application crashes or stale heap memory is exposed to the attacker","analyst_note":"Confirm the fixed FFmpeg version from the patch link on github.com and the vulncheck advisory; sources do not name it.","how_to_check":"- Check the installed FFmpeg version with `ffmpeg -version`\n- Check whether the build uses NVDEC hardware decoding (`-hwaccel nvdec` or `cuvid` decoders) in your pipeline","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-nvdec","trusted-input-only"],"who_is_affected":"Systems that decode untrusted video with FFmpeg's NVDEC hardware path (libavcodec/nvdec.c) are exposed, since a crafted file is the trigger. Services that only process trusted or internally produced media, or that do not use NVDEC, are less exposed. The sources do not say which distributions or builds ship the patch.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000772,"input_tokens":4640,"output_tokens":615,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125265':14A,17A '-2026':13A,16A '9.0.2':29B,67C 'abandon':96C 'applic':58B,110C 'attack':56B,90C 'bitstream':34B,86C 'caus':102C 'contain':68C 'content':64B,115C 'craft':2A,46B,93C 'crash':59B,109C 'ctx':85C 'cuviddecodepictur':103C 'cve':12A,15A 'decod':11A,40B 'end':100C 'error':43B,89C 'expos':112C 'fail':30B,82C 'ff':78C 'ffmpeg':1A,18B,27B,65C 'frame':81C,101C 'free':8A,73C 'freed':52B,106C 'get':57B 'hardwar':39B 'heap':53B,63B,107C,114C 'host':26B 'leak':61B 'libavcodec/nvdec.c':76C 'make':49B 'media':20B 'media-process':19B 'memori':54B,108C 'nvdec':10A,22B,38B,79C 'packag':23B 'pictur':98C 'pointer':35B 'process':21B 'read':51B,105C 'reset':32B,84C 'self':25B 'self-host':24B 'slice':42B,88C 'stale':62B,113C 'start':80C 'suppli':92C 'trigger':4A 'use':6A,71C 'use-after-fre':5A,70C 'video':3A,47B,94C 'vulner':74C","nicknames":[],"mitigations":[],"who_affected":"Systems that decode untrusted video with FFmpeg's NVDEC hardware path (libavcodec/nvdec.c) are exposed, since a crafted file is the trigger. Services that only process trusted or internally produced media, or that do not use NVDEC, are less exposed. The sources do not say which distributions or builds ship the patch.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ffmpeg","mediaprocessing","medium","nvdec","package","selfhosted"],"campaign_type":null,"search_a":"'-125265':14A,17A '-2026':13A,16A 'craft':2A 'cve':12A,15A 'decod':11A 'ffmpeg':1A 'free':8A 'nvdec':10A 'trigger':4A 'use':6A 'use-after-fre':5A 'video':3A","search_b":"'9.0.2':29B 'applic':58B 'attack':56B 'bitstream':34B 'content':64B 'craft':46B 'crash':59B 'decod':40B 'error':43B 'fail':30B 'ffmpeg':18B,27B 'freed':52B 'get':57B 'hardwar':39B 'heap':53B,63B 'host':26B 'leak':61B 'make':49B 'media':20B 'media-process':19B 'memori':54B 'nvdec':22B,38B 'packag':23B 'pointer':35B 'process':21B 'read':51B 'reset':32B 'self':25B 'self-host':24B 'slice':42B 'stale':62B 'video':47B","search_c":"'9.0.2':67C 'abandon':96C 'applic':110C 'attack':90C 'bitstream':86C 'caus':102C 'contain':68C 'content':115C 'craft':93C 'crash':109C 'ctx':85C 'cuviddecodepictur':103C 'end':100C 'error':89C 'expos':112C 'fail':82C 'ff':78C 'ffmpeg':65C 'frame':81C,101C 'free':73C 'freed':106C 'heap':107C,114C 'libavcodec/nvdec.c':76C 'memori':108C 'nvdec':79C 'pictur':98C 'read':105C 'reset':84C 'slice':88C 'stale':113C 'start':80C 'suppli':92C 'use':71C 'use-after-fre':70C 'video':94C 'vulner':74C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T20:18:13+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125265","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125265","severity":null,"published_at":"2026-11-09T20:18:13+00:00","modified_at":"2026-11-09T20:18:13+00:00","first_seen_at":"2026-11-09T20:48:14+00:00","fetched_at":"2026-11-09T20:48:14+00:00","note":null}],"documents":[{"id":109744,"url":"https://github.com/FFmpeg/FFmpeg/commit/03cd7851955c023f1ff4c8a495d47e996d01485a","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109745,"url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-use-after-free-via-nvdec-stale-bitstream-pointer","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}