CVE-2026-125239: FFmpeg through 9.0.2 Heap Buffer Overflow via HEVC DXVA Tile Parameters

Q: Which systems are exposed to this issue?

The issue applies to FFmpeg through 9.0.2 when HEVC content is decoded on Windows through a DXVA hardware-acceleration path: DXVA2, D3D11VA, or D3D12VA. Systems not using those Windows decoding paths are not identified as affected by the provided data.

Q: What must an attacker provide to trigger the overflow?

An attacker must cause the target to decode a crafted HEVC bitstream containing a large number of non-uniformly spaced tiles. The supplied data indicates the malformed tile parameters cause controlled 16-bit writes beyond fixed-size DXVA arrays.

Q: Does exploitation require prior authentication or user interaction?

The supplied vector lists no privileges required and user interaction required. In practice, the crafted HEVC content must be provided to a workflow that decodes it through an affected Windows hardware-acceleration path.

Published Nov 9, 2026

Updated

FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in ffdxva2hevcfillpictureparameters() that allows attackers to corrupt memory via unbounded non-uniform tile counts. Attackers can supply crafted HEVC bitstreams with many non-uniformly spaced tiles to write controlled 16-bit values past fixed-size DXVA arrays during DXVA2, D3D11VA, or D3D12VA decoding on Windows.

Affected Software

1 affected component

FFmpeg FFmpeg<=9.0.2

Event History

Nov 9, 2026

CVE Published

via MITRE·07:11 PM

Data Sourced

via MITRE·07:11 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which systems are exposed to this issue?

The issue applies to FFmpeg through 9.0.2 when HEVC content is decoded on Windows through a DXVA hardware-acceleration path: DXVA2, D3D11VA, or D3D12VA. Systems not using those Windows decoding paths are not identified as affected by the provided data.

What must an attacker provide to trigger the overflow?

An attacker must cause the target to decode a crafted HEVC bitstream containing a large number of non-uniformly spaced tiles. The supplied data indicates the malformed tile parameters cause controlled 16-bit writes beyond fixed-size DXVA arrays.

Does exploitation require prior authentication or user interaction?

The supplied vector lists no privileges required and user interaction required. In practice, the crafted HEVC content must be provided to a workflow that decodes it through an affected Windows hardware-acceleration path.

CVE-2026-125239: FFmpeg through 9.0.2 Heap Buffer Overflow via HEVC DXVA Tile Parameters

Affected Software

Event History

Frequently Asked Questions

Which systems are exposed to this issue?

What must an attacker provide to trigger the overflow?

Does exploitation require prior authentication or user interaction?

Company

Resources

Contact

Frequently Asked Questions

Which systems are exposed to this issue?

What must an attacker provide to trigger the overflow?

Does exploitation require prior authentication or user interaction?