CVE-2026-125219: FFmpeg through 9.0.2 Heap Buffer Overflow via HEVC VDPAU Tile Arrays

Q: Which applications are exposed?

Applications that use FFmpeg through 9.0.2 for HEVC decoding with the VDPAU hardware-acceleration path are affected. FFmpeg use without VDPAU HEVC decoding is not identified as affected by the provided data.

Q: What does an attacker need to provide to trigger the issue?

An attacker needs to supply a crafted HEVC bitstream with excessive PPS tile-column or tile-row counts. Exploitation requires the vulnerable application to process that stream using VDPAU HEVC decoding.

Q: What is the effect of successful exploitation?

The vulnerable function can copy unbounded tile counts into fixed-size VDPAU arrays, writing controlled 16-bit values past heap-allocated hardware-acceleration data. This corrupts process memory and is rated high severity with impacts to confidentiality, integrity, and availability.

Published Nov 9, 2026

Updated

FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in vdpauhevcstartframe() in libavcodec/vdpauhevc.c that copies unbounded PPS tile counts into fixed-size VDPAU arrays. Attackers can supply crafted HEVC bitstreams with excessive tile columns or rows to write controlled 16-bit values past heap-allocated hwaccel data, corrupting memory in applications using VDPAU decoding.

Affected Software

1 affected component

FFmpeg FFmpeg<=9.0.2

Event History

Nov 9, 2026

CVE Published

via MITRE·07:11 PM

Data Sourced

via MITRE·07:11 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which applications are exposed?

Applications that use FFmpeg through 9.0.2 for HEVC decoding with the VDPAU hardware-acceleration path are affected. FFmpeg use without VDPAU HEVC decoding is not identified as affected by the provided data.

What does an attacker need to provide to trigger the issue?

An attacker needs to supply a crafted HEVC bitstream with excessive PPS tile-column or tile-row counts. Exploitation requires the vulnerable application to process that stream using VDPAU HEVC decoding.

What is the effect of successful exploitation?

The vulnerable function can copy unbounded tile counts into fixed-size VDPAU arrays, writing controlled 16-bit values past heap-allocated hardware-acceleration data. This corrupts process memory and is rated high severity with impacts to confidentiality, integrity, and availability.

CVE-2026-125219: FFmpeg through 9.0.2 Heap Buffer Overflow via HEVC VDPAU Tile Arrays

Affected Software

Event History

Frequently Asked Questions

Which applications are exposed?

What does an attacker need to provide to trigger the issue?

What is the effect of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which applications are exposed?

What does an attacker need to provide to trigger the issue?

What is the effect of successful exploitation?