PT-2026-141019

CVE-2026-125191

·

Published

2026-11-09

·

Updated

2026-11-09

Description by

CVSS 3.1
4.7
Medium
MetricsAV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
FFmpeg through 9.0.2 contains a reference count leak in libavcodec/v4l2 buffers.c that allows attackers to deadlock the V4L2 mem2mem decoder on multi-plane capture formats. Attackers can supply crafted H.264, HEVC, or VP9 streams with resolution changes, making ff v4l2 m2m codec reinit() wait forever and hang the decoding application.
Exploitability
Fix
Researchers
Vendors
Affected products
Weakness enumeration
CWE-911: Improper Update of Reference Count
Related identifiers
CVE-2026-125191
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com