CVE-2026-125265

FFmpeg through 9.0.2 contains a use-after-free vulnerability in libavcodec/nvdec.c because ff nvdec start frame() fails to reset ctx->bitstream after slice errors. Attackers can supply crafted video that abandons a picture before end frame, causing cuvidDecodePicture() to read freed heap memory, crashing applications or exposing stale heap contents.