CVE-2026-125265

Received Received - Intake

Heap Use-After-Free in FFmpeg libavcodec/nvdec

Publication date: 2026-11-09

Last updated on: 2026-11-09

Assigner: VulnCheck

Description

FFmpeg through 9.0.2 contains a use-after-free vulnerability in libavcodec/nvdec.c because ff_nvdec_start_frame() fails to reset ctx->bitstream after slice errors. Attackers can supply crafted video that abandons a picture before end_frame, causing cuvidDecodePicture() to read freed heap memory, crashing applications or exposing stale heap contents.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-11-09

Last Modified

2026-11-09

Generated

2026-11-10

AI Q&A

2026-11-10

EPSS Evaluated

N/A

NVD

CVE-2026-125265

EUVD

EUVD-2026-120215

Affected Vendors & Products

Vendor	Product	Version / Range
FFmpeg	FFmpeg	From 0 (inc) to 9.0.2 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

This is a use-after-free vulnerability in FFmpeg's NVDEC hardware acceleration module (libavcodec/nvdec.c). The issue occurs when ff_nvdec_start_frame() fails to reset the bitstream pointer after slice errors. Attackers can exploit this by providing crafted video files that abandon a picture before end_frame, causing cuvidDecodePicture() to read freed heap memory. This may crash applications or expose stale heap contents.

Detection Guidance

Detecting this vulnerability requires checking the FFmpeg version in use. Run `ffmpeg -version` to verify if your system uses version 9.0.2 or earlier. If so, the vulnerability may be present. Additionally, monitor for crashes or memory corruption during video decoding operations.

Impact Analysis

The vulnerability could allow attackers to crash applications processing media files or potentially execute arbitrary code by exploiting freed memory. Users of FFmpeg-based applications, especially those handling untrusted video files, may experience crashes or unexpected behavior. The impact depends on the application's use of FFmpeg and its privileges.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling memory corruption or arbitrary code execution through crafted video files. If exploited, it may lead to unauthorized data access, processing disruptions, or data breaches, which are critical violations under these regulations.

Mitigation Strategies

Immediately update FFmpeg to a patched version. Apply the fix from commit 03cd7851955c023f1ff4c8a495d47e996d01485a or upgrade to a newer release. If updating is not possible, disable NVDEC hardware acceleration by setting `-hwaccel none` in FFmpeg commands.

Hi! I’m here to help you understand CVE-2026-125265. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...