CVE-2026-125242: FFmpeg through 9.0.2 Memory Leak via VDPAU Hwaccel Bitstream Buffer Table

Q: Which deployments are in scope?

The affected component is FFmpeg's VDPAU hardware-acceleration code in libavcodec/vdpau.c. The issue is identified in FFmpeg versions through 9.0.2 when processing H.264 content.

Q: What does an attacker need to trigger the issue?

The attacker needs to provide a crafted H.264 stream containing malformed NAL units that cause pictures to be abandoned before end_frame. The CVSS vector indicates no privileges are required, but user interaction is required and the attack vector is local.

Q: What is the expected security impact?

Repeated triggering can continuously leak the bitstream_buffers table and exhaust heap memory, resulting in denial of service. The supplied CVSS vector indicates no confidentiality or integrity impact.

Published Nov 9, 2026

Updated

FFmpeg through 9.0.2 contains a memory leak vulnerability in libavcodec/vdpau.c that allows attackers to exhaust heap memory by aborting pictures before endframe. Attackers can supply crafted H.264 streams with malformed NAL units that repeatedly abandon pictures, leaking the bitstreambuffers table continuously and causing denial of service.

Affected Software

1 affected component

FFmpeg FFmpeg<=9.0.2

Event History

Nov 9, 2026

CVE Published

via MITRE·07:11 PM

Data Sourced

via MITRE·07:11 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are in scope?

The affected component is FFmpeg's VDPAU hardware-acceleration code in libavcodec/vdpau.c. The issue is identified in FFmpeg versions through 9.0.2 when processing H.264 content.

What does an attacker need to trigger the issue?

The attacker needs to provide a crafted H.264 stream containing malformed NAL units that cause pictures to be abandoned before end_frame. The CVSS vector indicates no privileges are required, but user interaction is required and the attack vector is local.

What is the expected security impact?

Repeated triggering can continuously leak the bitstream_buffers table and exhaust heap memory, resulting in denial of service. The supplied CVSS vector indicates no confidentiality or integrity impact.

CVE-2026-125242: FFmpeg through 9.0.2 Memory Leak via VDPAU Hwaccel Bitstream Buffer Table

Affected Software

Event History

Frequently Asked Questions

Which deployments are in scope?

What does an attacker need to trigger the issue?

What is the expected security impact?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are in scope?

What does an attacker need to trigger the issue?

What is the expected security impact?