CVE-2026-125191: FFmpeg through 9.0.2 V4L2 M2M Decoder Deadlock via Reference Count Leak
Published Nov 9, 2026
·Updated
FFmpeg through 9.0.2 contains a reference count leak in libavcodec/v4l2buffers.c that allows attackers to deadlock the V4L2 mem2mem decoder on multi-plane capture formats. Attackers can supply crafted H.264, HEVC, or VP9 streams with resolution changes, making ffv4l2m2mcodecreinit() wait forever and hang the decoding application.
Affected Software
1 affected component
FFmpeg FFmpeg<=9.0.2
Event History
Nov 9, 2026
CVE Published
via MITRE·07:11 PM
Data Sourced
via MITRE·07:11 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·07:16 PM
DescriptionSeverityWeakness
Event
via NVD·07:16 PM