CVE Alert: CVE-2026-125202 – FFmpeg

FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in vaapi_hevc_start_frame() in libavcodec/vaapi_hevc.c that copies unbounded PPS tile counts into fixed-size arrays. Attackers can supply a crafted HEVC bitstream with a large picture and many tiles to write controlled 16-bit values past heap-allocated hwaccel data, corrupting memory in applications decoding with VAAPI.

**Risk verdict:** High impact if successfully triggered, but exploitation is constrained by local access, a crafted input and user interaction; urgency cannot be calibrated fully because threat-intelligence flags are missing.

**Why this matters:** Successful memory corruption could disrupt a decoder and may provide a route to compromise the application or the account running it, though reliable code execution is not established by the supplied data. Likely attacker goals include crashing media-processing workflows or targeting a user who handles a malicious video.

**Most likely attack path:** An attacker persuades a user or an automated workflow to open or process a crafted HEVC file on a system using VAAPI decoding. Local access is required, and high complexity plus an additional attack precondition limits reach; no privileges are required once the victim processes the file. Scope is unchanged, so direct impact is within the vulnerable application’s security authority, with no indicated cross-boundary impact.

**Who is most exposed:** Workstations and media servers using FFmpeg with VAAPI enabled are the main concern, especially where untrusted uploads or received media are decoded automatically.

Review crashes and memory-sanitiser findings in FFmpeg decoding processes.

Identify VAAPI-enabled workloads processing untrusted HEVC files.

Correlate suspicious file ingestion with decoder failures or restarts.

Obtain KEV, SSVC, PoC and EPSS status to refine urgency.

Mitigation and prioritisation:

Upgrade to a vendor-confirmed fixed release; verify bundled FFmpeg versions.

Until patched, disable VAAPI HEVC decoding or route untrusted inputs to isolated workers.

Restrict file-processing permissions and limit access to decoded outputs.

Schedule changes promptly; priority 1 cannot be assigned without KEV or EPSS data.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.