CVE-2026-125265

MEDIUM 5.3

FFmpeg through 9.0.2 Use-After-Free via NVDEC Stale Bitstream Pointer

CVSS Score

5.3

EPSS Score

0.0%

EPSS Percentile

0th

FFmpeg through 9.0.2 contains a use-after-free vulnerability in libavcodec/nvdec.c because ff_nvdec_start_frame() fails to reset ctx->bitstream after slice errors. Attackers can supply crafted video that abandons a picture before end_frame, causing cuvidDecodePicture() to read freed heap memory, crashing applications or exposing stale heap contents.

CWE	CWE-416
Vendor	ffmpeg
Product	ffmpeg
Published	Nov 9, 2026

Stay Ahead of the Next One

Get instant alerts for ffmpeg ffmpeg

Be the first to know when new medium vulnerabilities affecting ffmpeg ffmpeg are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:H

Attack Vector

Local

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

High

Affected Versions

FFmpeg / FFmpeg

0 ≤ 9.0.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

code.ffmpeg.org: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25231 github.com: https://github.com/FFmpeg/FFmpeg/commit/03cd7851955c023f1ff4c8a495d47e996d01485a github.com: https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/nvdec.c#L694 github.com: https://github.com/FFmpeg/FFmpeg vulncheck.com: https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-use-after-free-via-nvdec-stale-bitstream-pointer

Credits

Joshua Rogers (AISLE Research) Michael Niedermayer