CVE-2026-125201

HIGH 7.0

FFmpeg 7.0 before 8.1.3 and 9.x before 9.0.2 Heap Overflow via vulkan_av1.c

CVSS Score

7.0

EPSS Score

0.0%

EPSS Percentile

0th

FFmpeg 7.0 before 8.1.3 and 9.x before 9.0.2 contains a heap out-of-bounds write vulnerability in vk_av1_decode_slice() in libavcodec/vulkan_av1.c because the tile-count limit is checked only on entry. Attackers can supply a crafted AV1 stream with more than 256 tiles decoded via the Vulkan hardware accelerator to overflow tile_sizes and corrupt heap memory.

CWE	CWE-787
Vendor	ffmpeg
Product	ffmpeg
Published	Nov 9, 2026

Stay Ahead of the Next One

Get instant alerts for ffmpeg ffmpeg

Be the first to know when new high vulnerabilities affecting ffmpeg ffmpeg are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

FFmpeg / FFmpeg

7.0 < 8.1.3 9.0 < 9.0.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

code.ffmpeg.org: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24289 github.com: https://github.com/FFmpeg/FFmpeg/commit/d29ff884221042af219e53cc339a62356b061816 github.com: https://github.com/FFmpeg/FFmpeg/blob/n9.0.1/libavcodec/vulkan_av1.c#L578 github.com: https://github.com/FFmpeg/FFmpeg vulncheck.com: https://www.vulncheck.com/advisories/ffmpeg-7.0-before-8.1.3-and-9-x-before-9.0.2-heap-overflow-via-vulkan-av1-c

Credits

Joshua Rogers (AISLE Research) Sylvestre Ledru