UBUNTU-CVE-2026-125265: Use After Free
FFmpeg through 9.0.2 contains a use-after-free vulnerability in libavcodec/nvdec.c because ffnvdecstartframe() fails to reset ctx->bitstream after slice errors. Attackers can supply crafted video that abandons a picture before endframe, causing cuvidDecodePicture() to read freed heap memory, crashing applications or exposing stale heap contents.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Applications using Ubuntu's FFmpeg package to decode untrusted video through the libavcodec NVDEC path are exposed if they use an affected FFmpeg version through 9.0.2.
What does exploitation require?
An attacker must provide specially crafted video that triggers slice errors and abandons a picture before end_frame. The CVSS vector indicates local attack access, high attack complexity, no privileges required, and user interaction is required.
How can I determine whether a system may be affected?
Check whether the system uses the Ubuntu FFmpeg package and whether its FFmpeg version is through 9.0.2. Also identify applications that process externally supplied video using NVDEC decoding.