CVE-2026-125265: FFmpeg through 9.0.2 Use-After-Free via NVDEC Stale Bitstream Pointer

Q: What conditions are needed to trigger the issue?

An attacker must provide crafted video that causes a picture to be abandoned before end_frame after slice errors. Exploitation also requires the affected content to be processed through FFmpeg's NVDEC decoding path, with user interaction required under the reported vector.

Q: Which deployments are most relevant to triage?

The affected code is in libavcodec/nvdec.c, so deployments using FFmpeg with NVDEC hardware decoding are the relevant exposure set. The issue is reported in FFmpeg through version 9.0.2.

Q: What could happen if exploitation succeeds?

cuvidDecodePicture() may read freed heap memory through a stale bitstream pointer. This can crash the application or expose stale heap contents.

Published Nov 9, 2026

Updated

FFmpeg through 9.0.2 contains a use-after-free vulnerability in libavcodec/nvdec.c because ffnvdecstartframe() fails to reset ctx->bitstream after slice errors. Attackers can supply crafted video that abandons a picture before endframe, causing cuvidDecodePicture() to read freed heap memory, crashing applications or exposing stale heap contents.

Affected Software

1 affected component

FFmpeg FFmpeg<=9.0.2

Event History

Nov 9, 2026

CVE Published

via MITRE·07:12 PM

Data Sourced

via MITRE·07:12 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What conditions are needed to trigger the issue?

An attacker must provide crafted video that causes a picture to be abandoned before end_frame after slice errors. Exploitation also requires the affected content to be processed through FFmpeg's NVDEC decoding path, with user interaction required under the reported vector.

Which deployments are most relevant to triage?

The affected code is in libavcodec/nvdec.c, so deployments using FFmpeg with NVDEC hardware decoding are the relevant exposure set. The issue is reported in FFmpeg through version 9.0.2.

What could happen if exploitation succeeds?

cuvidDecodePicture() may read freed heap memory through a stale bitstream pointer. This can crash the application or expose stale heap contents.

CVE-2026-125265: FFmpeg through 9.0.2 Use-After-Free via NVDEC Stale Bitstream Pointer

Affected Software

Event History

Frequently Asked Questions

What conditions are needed to trigger the issue?

Which deployments are most relevant to triage?

What could happen if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

What conditions are needed to trigger the issue?

Which deployments are most relevant to triage?

What could happen if exploitation succeeds?