UBUNTU-CVE-2026-125249: Integer Overflow
FFmpeg 7.1 through 9.0.2 contains an integer overflow in ffvkdecodeaddslice() in libavcodec/vulkandecode.c that miscalculates the Vulkan hwaccel bitstream buffer size. Attackers can supply a crafted stream with over 2 GiB of slice data per frame, causing memcpy() to write past a smaller pooled host-mapped buffer.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Ubuntu systems using FFmpeg versions 7.1 through 9.0.2 are affected when they process streams through the Vulkan hardware-accelerated decoding path.
What must an attacker provide to trigger the flaw?
An attacker must supply a crafted media stream containing more than 2 GiB of slice data in a frame. Exploitation also requires local access, high attack complexity, and user interaction according to the supplied severity vector.
What is the impact if exploitation succeeds?
The integer overflow can cause memcpy() to write beyond a smaller pooled host-mapped buffer. The reported impact includes high confidentiality, integrity, and availability effects.