CVE-2026-125249FFmpeg 7.1 through 9.0.2 Heap Out-of-Bounds Write via Vulkan Slice Buffer Sizing

Descripción

FFmpeg 7.1 through 9.0.2 contains an integer overflow in ff_vk_decode_add_slice() in libavcodec/vulkan_decode.c that miscalculates the Vulkan hwaccel bitstream buffer size. Attackers can supply a crafted stream with over 2 GiB of slice data per frame, causing memcpy() to write past a smaller pooled host-mapped buffer.

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

Referencias y parches

• https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25136 issue-tracking
• https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/vulkan_decode.c#L345 technical-description
• https://github.com/FFmpeg/FFmpeg product
• VulnCheck Advisory: FFmpeg 7.1 through 9.0.2 Heap Out-of-Bounds Write via Vulkan Slice Buffer Sizing third-party-advisory