FFmpeg: Integer overflow in vulkan_decode.c (CVE-2026-125249)
FFmpeg 7.1 through 9.0.2 contains an integer overflow in ff_vk_decode_add_slice() in libavcodec/vulkan_decode.c that miscalculates the Vulkan hwaccel bitstream buffer size.
CVE search metadata
CVE search record: CVE-2026-125249. Severity: high. CVSS: 7.0. KEV: no. Product: FFmpeg (7.1 through 9.0.2). Brief: FFmpeg: Integer overflow in vulkan_decode.c (CVE-2026-125249). Brief link: https://feed.craftedsignal.io/briefs/2026-11-ffmpeg-vuln/
Triage facts
Revision 1- Applicability
- FFmpeg (7.1 through 9.0.2)
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 9, 19:56 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
FFmpeg 7.1 through 9.0.2 contains an integer overflow in the ff_vk_decode_add_slice() function in libavcodec/vulkan_decode.c. This flaw causes a miscalculation of the Vulkan hwaccel bitstream buffer size. Attackers can supply a crafted stream with over 2 GiB of slice data per frame, causing memcpy() to write past a smaller pooled host-mapped buffer.