CVE-2026-125255: FFmpeg through 9.0.2 Use-After-Free in MJPEG Hardware-Accelerated Decoding

Q: Which deployments are most exposed?

Applications that decode attacker-supplied MJPEG streams using FFmpeg, particularly with hardware-accelerated decoders such as NVDEC, are exposed. The affected code is in FFmpeg's MJPEG decoder.

Q: What does an attacker need to provide?

The attacker needs to cause the application to process a crafted MJPEG stream containing a SOF marker without a preceding SOI marker. The supplied stream can cause a stale raw_image_buffer pointer to be passed to a hardware-acceleration decoder.

Q: What is the practical impact?

Successful triggering can crash the application or expose heap contents through reads from freed buffers. The CVSS vector indicates local attack access, high attack complexity, no required privileges, and user interaction.

Published Nov 9, 2026

Updated

FFmpeg through 9.0.2 contains a use after free vulnerability in libavcodec/mjpegdec.c that allows attackers to trigger freed buffer reads by sending a SOF marker without a preceding SOI. Attackers can supply crafted MJPEG streams causing ffmjpegdecodesof() to pass a stale rawimagebuffer pointer to hwaccel decoders like NVDEC, crashing applications or leaking heap contents.

Affected Software

1 affected component

FFmpeg FFmpeg<=9.0.2

Event History

Nov 9, 2026

CVE Published

via MITRE·07:11 PM

Data Sourced

via MITRE·07:11 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are most exposed?

Applications that decode attacker-supplied MJPEG streams using FFmpeg, particularly with hardware-accelerated decoders such as NVDEC, are exposed. The affected code is in FFmpeg's MJPEG decoder.

What does an attacker need to provide?

The attacker needs to cause the application to process a crafted MJPEG stream containing a SOF marker without a preceding SOI marker. The supplied stream can cause a stale raw_image_buffer pointer to be passed to a hardware-acceleration decoder.

What is the practical impact?

Successful triggering can crash the application or expose heap contents through reads from freed buffers. The CVSS vector indicates local attack access, high attack complexity, no required privileges, and user interaction.

CVE-2026-125255: FFmpeg through 9.0.2 Use-After-Free in MJPEG Hardware-Accelerated Decoding

Affected Software

Event History

Frequently Asked Questions

Which deployments are most exposed?

What does an attacker need to provide?

What is the practical impact?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are most exposed?

What does an attacker need to provide?

What is the practical impact?