UBUNTU-CVE-2026-125252: Medium severity ubuntu/ffmpeg vulnerability
FFmpeg through 9.0.2 contains a memory leak vulnerability in libavcodec/vaapidecode.c that allows attackers to exhaust memory by supplying streams with slice parse errors. Attackers can craft H.264 or other VAAPI-decoded video where later slices fail to parse on every frame, continuously leaking VA parameter and slice buffers plus driver and heap memory.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments that use FFmpeg with VAAPI decoding are exposed when they process attacker-supplied H.264 or other VAAPI-decoded video streams. The issue is in libavcodec/vaapi_decode.c.
What does an attacker need to do to trigger the leak?
An attacker needs to supply a crafted video stream whose later slices fail to parse on every frame. Exploitation requires local attack vector conditions, high attack complexity, and user interaction according to the provided severity vector.
What is the practical impact of successful exploitation?
Repeated decode failures can continuously leak VA parameter and slice buffers, along with driver and heap memory. This can exhaust available memory and cause an availability impact.