UBUNTU-CVE-2026-125242: Medium severity ubuntu/ffmpeg vulnerability

Published Nov 10, 2026

Updated

FFmpeg through 9.0.2 contains a memory leak vulnerability in libavcodec/vdpau.c that allows attackers to exhaust heap memory by aborting pictures before endframe. Attackers can supply crafted H.264 streams with malformed NAL units that repeatedly abandon pictures, leaking the bitstreambuffers table continuously and causing denial of service.

Affected Software

7 affected components

ubuntu/ffmpeg*

Event History

Nov 10, 2026

CVE Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which systems are exposed to this issue?

Systems running Ubuntu's FFmpeg package may be exposed when they process attacker-supplied H.264 streams through the affected VDPAU decoder code in libavcodec/vdpau.c.

What must an attacker provide to trigger the denial of service?

An attacker needs to supply a crafted H.264 stream containing malformed NAL units that cause pictures to be aborted before end_frame. Repeatedly triggering this condition leaks bitstream buffer table memory until heap memory is exhausted.

What is the practical impact of successful exploitation?

Successful exploitation can continuously consume heap memory and cause a denial of service. The provided data does not indicate impacts to confidentiality or integrity.

UBUNTU-CVE-2026-125242: Medium severity ubuntu/ffmpeg vulnerability

Affected Software

Event History

Frequently Asked Questions

Which systems are exposed to this issue?

What must an attacker provide to trigger the denial of service?

What is the practical impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which systems are exposed to this issue?

What must an attacker provide to trigger the denial of service?

What is the practical impact of successful exploitation?