UBUNTU-CVE-2026-125237: Medium severity ubuntu/ffmpeg vulnerability
FFmpeg 8.1 through 9.0.2 contains a denial of service vulnerability in libavcodec/dpx.c that leaves dpx->hwaccelpictureprivate allocated when Vulkan hwaccel callbacks fail. Attackers can supply crafted DPX images that make startframe, decodeslice or endframe fail, triggering an avassert0 abort on the next frame and terminating the decoding application.
Affected Software
Event History
Frequently Asked Questions
What conditions are required to trigger the denial of service?
An attacker must be able to provide a crafted DPX image to an application using FFmpeg's Vulkan hardware-acceleration path. The image must cause a Vulkan hwaccel callback such as start_frame, decode_slice, or end_frame to fail; processing a subsequent frame then triggers the assertion abort.
What is the practical impact on an affected application?
The decoding application terminates when av_assert0 aborts on the next frame. The available data describes denial of service only and does not indicate confidentiality or integrity impact.
Are systems using FFmpeg without Vulkan hardware acceleration affected?
The described issue is specifically tied to failure handling in Vulkan hwaccel callbacks in libavcodec/dpx.c. The provided information does not establish impact for DPX decoding paths that do not use Vulkan hardware acceleration.
Which FFmpeg versions are identified as affected?
FFmpeg versions 8.1 through 9.0.2 are identified as containing the vulnerability. The provided data does not specify an Ubuntu package revision or fixed version.