Vulnerability in Ffmpeg
CVE-2026-125245
FFmpeg through 9.0.2 contains a memory leak vulnerability in ff_mjpeg_decode_sof() in libavcodec/mjpegdec.c, which overwrites the hwaccel_picture_private pointer without freeing it. Attackers can supply crafted MJPEG streams with repeated SOF markers or failing frames to leak hwaccel private data and hardware buffers under VAAPI or NVDEC decoding.
Published .
CVSS v3 metric
CVSS v3 base score 4.7 (Medium). Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
Weakness classification (CWE)
References
- code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25231 (issue-tracking)
- github.com/FFmpeg/FFmpeg (product)
- github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/mjpegdec.c (technical-description)
- Patch Commit (patch)
- VulnCheck Advisory: FFmpeg through 9.0.2 Memory Leak in MJPEG Hwaccel SOF Decoding (third-party-advisory)
Frequently asked questions
- What is CVE-2026-125245?
- CVE-2026-125245 is a medium-severity vulnerability in Ffmpeg, classified under Missing Release of Memory after Effective Lifetime. CVSS score: 4.7/10. Published 2026-11-09.
- How severe is CVE-2026-125245?
- Medium severity. CVSS v3 base score is 4.7 out of 10.