CVE-2026-125237: FFmpeg 8.1 through 9.0.2 Denial of Service via DPX Vulkan Hwaccel Error Path

Q: Which deployments are exposed to this issue?

The affected range is FFmpeg 8.1 through 9.0.2. Exposure requires DPX decoding on the Vulkan hardware-acceleration path, because the flaw is triggered when Vulkan hwaccel callbacks fail.

Q: What does an attacker need to trigger the denial of service?

An attacker needs to provide a crafted DPX image that causes the start_frame, decode_slice, or end_frame callback to fail. The CVSS vector indicates local attack access, no privileges required, user interaction required, and high attack complexity.

Q: How would this failure appear during processing?

After a relevant Vulkan hwaccel callback failure leaves DPX picture-private state allocated, processing the next frame can hit an av_assert0 abort. This terminates the decoding application, producing a denial of service.

Published Nov 9, 2026

Updated

FFmpeg 8.1 through 9.0.2 contains a denial of service vulnerability in libavcodec/dpx.c that leaves dpx->hwaccelpictureprivate allocated when Vulkan hwaccel callbacks fail. Attackers can supply crafted DPX images that make startframe, decodeslice or endframe fail, triggering an avassert0 abort on the next frame and terminating the decoding application.

Affected Software

1 affected component

FFmpeg FFmpeg>=8.1<=9.0.2

Event History

Nov 9, 2026

CVE Published

via MITRE·07:11 PM

Data Sourced

via MITRE·07:11 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

The affected range is FFmpeg 8.1 through 9.0.2. Exposure requires DPX decoding on the Vulkan hardware-acceleration path, because the flaw is triggered when Vulkan hwaccel callbacks fail.

What does an attacker need to trigger the denial of service?

An attacker needs to provide a crafted DPX image that causes the start_frame, decode_slice, or end_frame callback to fail. The CVSS vector indicates local attack access, no privileges required, user interaction required, and high attack complexity.

How would this failure appear during processing?

After a relevant Vulkan hwaccel callback failure leaves DPX picture-private state allocated, processing the next frame can hit an av_assert0 abort. This terminates the decoding application, producing a denial of service.

CVE-2026-125237: FFmpeg 8.1 through 9.0.2 Denial of Service via DPX Vulkan Hwaccel Error Path

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to trigger the denial of service?

How would this failure appear during processing?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to trigger the denial of service?

How would this failure appear during processing?