CVE-2026-125202: FFmpeg through 9.0.2 Heap Buffer Overflow via HEVC VAAPI Tile Arrays

Q: Which deployments are exposed to this issue?

Applications decoding HEVC content with FFmpeg using the VAAPI hardware-acceleration path are exposed. The vulnerable code is in vaapi_hevc_start_frame() in libavcodec/vaapi_hevc.c.

Q: What must an attacker provide to trigger the overflow?

An attacker needs to cause the application to decode a crafted HEVC bitstream containing a large picture and many tiles. Exploitation relies on unbounded PPS tile counts being copied into fixed-size tile arrays.

Q: Does exploitation require prior access or user interaction?

The supplied severity vector indicates no privileges are required and local attack vector conditions, but user interaction is required. The data does not specify the exact interaction needed in a particular application.

Published Nov 9, 2026

Updated

FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in vaapihevcstartframe() in libavcodec/vaapihevc.c that copies unbounded PPS tile counts into fixed-size arrays. Attackers can supply a crafted HEVC bitstream with a large picture and many tiles to write controlled 16-bit values past heap-allocated hwaccel data, corrupting memory in applications decoding with VAAPI.

Affected Software

1 affected component

FFmpeg FFmpeg<=9.0.2

Event History

Nov 9, 2026

CVE Published

via MITRE·07:11 PM

Data Sourced

via MITRE·07:11 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Applications decoding HEVC content with FFmpeg using the VAAPI hardware-acceleration path are exposed. The vulnerable code is in vaapi_hevc_start_frame() in libavcodec/vaapi_hevc.c.

What must an attacker provide to trigger the overflow?

An attacker needs to cause the application to decode a crafted HEVC bitstream containing a large picture and many tiles. Exploitation relies on unbounded PPS tile counts being copied into fixed-size tile arrays.

Does exploitation require prior access or user interaction?

The supplied severity vector indicates no privileges are required and local attack vector conditions, but user interaction is required. The data does not specify the exact interaction needed in a particular application.

CVE-2026-125202: FFmpeg through 9.0.2 Heap Buffer Overflow via HEVC VAAPI Tile Arrays

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What must an attacker provide to trigger the overflow?

Does exploitation require prior access or user interaction?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What must an attacker provide to trigger the overflow?

Does exploitation require prior access or user interaction?