CVE-2026-125249: FFmpeg 7.1 through 9.0.2 Heap Out-of-Bounds Write via Vulkan Slice Buffer Sizing

Q: Which deployments are exposed to this issue?

The issue affects FFmpeg versions 7.1 through 9.0.2 when processing streams through the Vulkan hardware-accelerated decode path. The vulnerable code is in libavcodec/vulkan_decode.c.

Q: What must an attacker provide to trigger the vulnerability?

An attacker must cause FFmpeg to process a crafted stream containing more than 2 GiB of slice data in a frame. The malformed slice sizing triggers an integer overflow and can make memcpy() write beyond the allocated pooled host-mapped buffer.

Q: Is interaction required for exploitation?

The supplied vector indicates local attack access and user interaction are required. No privileges are required according to the vector.

Published Nov 9, 2026

Updated

FFmpeg 7.1 through 9.0.2 contains an integer overflow in ffvkdecodeaddslice() in libavcodec/vulkandecode.c that miscalculates the Vulkan hwaccel bitstream buffer size. Attackers can supply a crafted stream with over 2 GiB of slice data per frame, causing memcpy() to write past a smaller pooled host-mapped buffer.

Affected Software

1 affected component

FFmpeg FFmpeg>=7.1<=9.0.2

Event History

Nov 9, 2026

CVE Published

via MITRE·07:11 PM

Data Sourced

via MITRE·07:11 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

The issue affects FFmpeg versions 7.1 through 9.0.2 when processing streams through the Vulkan hardware-accelerated decode path. The vulnerable code is in libavcodec/vulkan_decode.c.

What must an attacker provide to trigger the vulnerability?

An attacker must cause FFmpeg to process a crafted stream containing more than 2 GiB of slice data in a frame. The malformed slice sizing triggers an integer overflow and can make memcpy() write beyond the allocated pooled host-mapped buffer.

Is interaction required for exploitation?

The supplied vector indicates local attack access and user interaction are required. No privileges are required according to the vector.

CVE-2026-125249: FFmpeg 7.1 through 9.0.2 Heap Out-of-Bounds Write via Vulkan Slice Buffer Sizing

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What must an attacker provide to trigger the vulnerability?

Is interaction required for exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What must an attacker provide to trigger the vulnerability?

Is interaction required for exploitation?