PT-2026-141030
CVE-2026-125202
·
Published
2026-11-09
·
Updated
2026-11-09
Description by
CVSS 3.1
7.0
HighMetricsAV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in vaapi hevc start frame() in libavcodec/vaapi hevc.c that copies unbounded PPS tile counts into fixed-size arrays. Attackers can supply a crafted HEVC bitstream with a large picture and many tiles to write controlled 16-bit values past heap-allocated hwaccel data, corrupting memory in applications decoding with VAAPI.
Found an issue in the description? Have something to add? Feel free to write us 👾