GHSA-q4mw-m3xr-283rMediumCVSS 4.7
FFmpeg through 9.0.2 contains a memory leak vulnerability in libavcodec/vaapi_decode.c that...
🔗 CVE IDs covered (1)
📋 Description
FFmpeg through 9.0.2 contains a memory leak vulnerability in libavcodec/vaapi_decode.c that allows attackers to exhaust memory by supplying streams with slice parse errors. Attackers can craft H.264 or other VAAPI-decoded video where later slices fail to parse on every frame, continuously leaking VA parameter and slice buffers plus driver and heap memory.
🔗 References (8)
- https://nvd.nist.gov/vuln/detail/CVE-2026-125252
- https://github.com/FFmpeg/FFmpeg/commit/4221a63ce869ade862557ca64693bf77f5032971
- https://github.com/FFmpeg/FFmpeg/commit/838c660bb3cd66ba74981b453c14c79214f6ef92
- https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25231
- https://github.com/FFmpeg/FFmpeg
- https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/vaapi_decode.c#L117
- https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-vaapi-memory-leak-via-abandoned-picture-buffers
- https://github.com/advisories/GHSA-q4mw-m3xr-283r