CVE-2026-125201

FFmpeg 7.0 before 8.1.3 and 9.x before 9.0.2 contains a heap out-of-bounds write vulnerability in vk av1 decode slice() in libavcodec/vulkan av1.c because the tile-count limit is checked only on entry. Attackers can supply a crafted AV1 stream with more than 256 tiles decoded via the Vulkan hardware accelerator to overflow tile sizes and corrupt heap memory.