UBUNTU-CVE-2026-125191: Medium severity ubuntu/ffmpeg vulnerability
FFmpeg through 9.0.2 contains a reference count leak in libavcodec/v4l2buffers.c that allows attackers to deadlock the V4L2 mem2mem decoder on multi-plane capture formats. Attackers can supply crafted H.264, HEVC, or VP9 streams with resolution changes, making ffv4l2m2mcodecreinit() wait forever and hang the decoding application.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using FFmpeg with the V4L2 mem2mem decoder on multi-plane capture formats are affected. The impact is a hang of the decoding application rather than a confidentiality or integrity impact.
What must an attacker provide to trigger the hang?
An attacker must supply a crafted H.264, HEVC, or VP9 stream that includes resolution changes. Exploitation requires local attack vector conditions, high attack complexity, and user interaction according to the supplied severity vector.
How can I identify a likely affected workload?
A likely affected workload decodes H.264, HEVC, or VP9 through FFmpeg using V4L2 mem2mem with multi-plane capture formats, especially where input streams can contain resolution changes. A successful trigger causes ff_v4l2_m2m_codec_reinit() to wait indefinitely and the decoding application to hang.