CVE-2026-125265 | FFmpeg up to 9.0.2 NVDEC libavcodec/nvdec.c ff_nvdec_start_frame bitstream use after free

November 9, 2026 Yanac

A vulnerability marked as problematic has been reported in FFmpeg up to 9.0.2. This affects the function ff_nvdec_start_frame of the file libavcodec/nvdec.c of the component NVDEC. The manipulation of the argument bitstream leads to use after free.

This vulnerability is referenced as CVE-2026-125265. The attack can only be performed from a local environment. No exploit is available.VulDB Recent EntriesRead More