CVE-2026-125245: FFmpeg through 9.0.2 Memory Leak in MJPEG Hwaccel SOF Decoding

Q: Which deployments are exposed to this issue?

Deployments that decode attacker-controlled MJPEG streams using the VAAPI or NVDEC hardware-acceleration paths are exposed. The affected code is in FFmpeg through 9.0.2.

Q: What must an attacker provide to trigger the leak?

An attacker must cause the target to decode a crafted MJPEG stream. The stream can use repeated SOF markers or failing frames to overwrite the hwaccel_picture_private pointer without freeing the prior allocation.

Q: What is the operational impact of successful exploitation?

Repeated triggering can leak hardware-acceleration private data and hardware buffers, causing resource consumption that can lead to denial of service. The provided severity vector indicates local access, high attack complexity, and user interaction are required.

Published Nov 9, 2026

Updated

FFmpeg through 9.0.2 contains a memory leak vulnerability in ffmjpegdecodesof() in libavcodec/mjpegdec.c, which overwrites the hwaccelpictureprivate pointer without freeing it. Attackers can supply crafted MJPEG streams with repeated SOF markers or failing frames to leak hwaccel private data and hardware buffers under VAAPI or NVDEC decoding.

Affected Software

1 affected component

FFmpeg FFmpeg<=9.0.2

Event History

Nov 9, 2026

CVE Published

via MITRE·07:11 PM

Data Sourced

via MITRE·07:11 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:17 PM

DescriptionSeverityWeakness

Event

via NVD·07:17 PM

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments that decode attacker-controlled MJPEG streams using the VAAPI or NVDEC hardware-acceleration paths are exposed. The affected code is in FFmpeg through 9.0.2.

What must an attacker provide to trigger the leak?

An attacker must cause the target to decode a crafted MJPEG stream. The stream can use repeated SOF markers or failing frames to overwrite the hwaccel_picture_private pointer without freeing the prior allocation.

What is the operational impact of successful exploitation?

Repeated triggering can leak hardware-acceleration private data and hardware buffers, causing resource consumption that can lead to denial of service. The provided severity vector indicates local access, high attack complexity, and user interaction are required.

CVE-2026-125245: FFmpeg through 9.0.2 Memory Leak in MJPEG Hwaccel SOF Decoding

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What must an attacker provide to trigger the leak?

What is the operational impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What must an attacker provide to trigger the leak?

What is the operational impact of successful exploitation?