UBUNTU-CVE-2026-125255: Use After Free
FFmpeg through 9.0.2 contains a use after free vulnerability in libavcodec/mjpegdec.c that allows attackers to trigger freed buffer reads by sending a SOF marker without a preceding SOI. Attackers can supply crafted MJPEG streams causing ffmjpegdecodesof() to pass a stale rawimagebuffer pointer to hwaccel decoders like NVDEC, crashing applications or leaking heap contents.
Affected Software
Event History
Frequently Asked Questions
What input or attacker capability is needed to trigger the issue?
An attacker needs to supply a crafted MJPEG stream containing an SOF marker without a preceding SOI marker. Exploitation requires the affected application to process that stream and user interaction is required.
Which deployments are most exposed?
Applications that decode untrusted MJPEG streams through FFmpeg are exposed, particularly when using hardware-accelerated decoders such as NVDEC. The described impact is application crashes or possible disclosure of heap contents.
How can I determine whether an application may be affected?
Check whether the application uses FFmpeg through version 9.0.2, processes MJPEG input, and can route decoding through a hardware-acceleration decoder such as NVDEC. The vulnerable path involves ff_mjpeg_decode_sof() passing a stale raw_image_buffer pointer after malformed marker ordering.