CVE-2026-125252: FFmpeg through 9.0.2 VAAPI Memory Leak via Abandoned Picture Buffers
FFmpeg through 9.0.2 contains a memory leak vulnerability in libavcodec/vaapidecode.c that allows attackers to exhaust memory by supplying streams with slice parse errors. Attackers can craft H.264 or other VAAPI-decoded video where later slices fail to parse on every frame, continuously leaking VA parameter and slice buffers plus driver and heap memory.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments that use FFmpeg's VAAPI decoding path for H.264 or other VAAPI-decoded video are exposed when they process attacker-supplied streams containing repeated slice parse errors. The issue is local in the supplied severity vector and requires user interaction.
What does an attacker need to do to trigger the leak?
An attacker must provide a crafted video stream processed through VAAPI decoding. The stream causes later slices to fail parsing on every frame, leading to continued allocation leakage.
What is the practical impact of successful exploitation?
Repeated decoding of the malformed stream can exhaust memory. The described leaked resources include VA parameter and slice buffers, driver memory, and heap memory, resulting in a denial of service.