# CVE-2026-125242: FFmpeg memory leak in VDPAU decoder in libavcodec

Source: https://junglewise.ai/threats/cve-2026-125242-ffmpeg-through-9-0-2-contains-a-memory-leak-vulnerability-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-09. Updated: 2026-11-09  
License: CC BY 4.0 with a link back

CVE-2026-125242 · Severity: medium · CVSS 4.7 · Published 2026-11-09

FFmpeg is a multimedia processing library used to decode and play video and audio files. This vulnerability causes the VDPAU hardware video decoder to leak memory when processing malformed H.264 video streams, allowing an attacker to exhaust available memory and crash applications that decode video. An attacker could trigger a denial of service by providing a crafted video file.

Technologies: [Ffmpeg](https://junglewise.ai/threats/technologies/ffmpeg). Vendors: [Ffmpeg](https://junglewise.ai/threats/vendors/ffmpeg).

## Quick answers

**Is CVE-2026-125242 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-125242 being exploited in the wild.

**How severe is CVE-2026-125242?** Medium severity, with a CVSS score of 4.7, published 9 November 2026.

**Which products and versions are affected?** Ffmpeg through 9.0.2.

**Is there a fix for CVE-2026-125242?** A patch was published on 2026-10-27: Fix merged in pull request #25231 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-125242 attacked?** It is attacked over the network or with local access.

**Am I affected by CVE-2026-125242?** Check whether you run Ffmpeg at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A memory leak exists in libavcodec/vdpau.c where the bitstream_buffers table is not freed when pictures are abandoned before the end_frame call. Attackers can supply crafted H.264 streams with malformed NAL units that repeatedly abandon pictures to trigger continuous memory leaks. The vulnerability requires network or local delivery of a malformed video file to a system running vulnerable FFmpeg, and results in denial of service through memory exhaustion.

## Affected products

- FFmpeg FFmpeg through 9.0.2

## Timeline

- 2026-11-09: disclosed
- 2026-10-27: patched: Fix merged in pull request #25231

## References

- [https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25231](https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25231)
- [https://github.com/FFmpeg/FFmpeg](https://github.com/FFmpeg/FFmpeg)

## Related threats

- [FFmpeg heap out-of-bounds read in v4l2_buffers](https://junglewise.ai/threats/cve-2026-125270-ffmpeg-through-9-0-2-contains-a-heap-out-of-bounds-read)
- [FFmpeg double free in H.264 SEI message handling](https://junglewise.ai/threats/cve-2026-125269-ffmpeg-through-9-0-2-contains-a-double-free-vulnerability-in)
- [FFmpeg heap out-of-bounds write in APAC decoder](https://junglewise.ai/threats/cve-2026-125267-ffmpeg-before-8-1-3-and-9-x-before-9-0-2-contains-a-heap-out-of)
- [FFmpeg use-after-free in NVIDIA codec decoding](https://junglewise.ai/threats/cve-2026-125265-ffmpeg-through-9-0-2-contains-a-use-after-free-vulnerability-in)
- [FFmpeg JPEG XL parser uncontrolled resource consumption](https://junglewise.ai/threats/cve-2026-125264-ffmpeg-through-9-0-2-contains-an-uncontrolled-resource)