CVE-2026-125237

FFmpeg 8.1 through 9.0.2 contains a denial of service vulnerability in libavcodec/dpx.c that leaves dpx->hwaccel picture private allocated when Vulkan hwaccel callbacks fail. Attackers can supply crafted DPX images that make start frame, decode slice or end frame fail, triggering an av assert0 abort on the next frame and terminating the decoding application.