CVE-2026-125249
HIGH
MEDIUM
Priority: 0.01
BB Relevance:
30/100
Published: 2026-11-09
Modified: 2026-11-10
First seen: 2026-11-09
Status: active
Attack Surface
No Auth
Conf. Impact
Integ. Impact
CVSS Vector Breakdown
AV:
Local
AC:
High
PR:
None
UI:
Passive
S:
X
AT:
Present
VC:
High
VI:
High
VA:
High
Description
FFmpeg 7.1 through 9.0.2 contains an integer overflow in ff_vk_decode_add_slice() in libavcodec/vulkan_decode.c that miscalculates the Vulkan hwaccel bitstream buffer size. Attackers can supply a crafted stream with over 2 GiB of slice data per frame, causing memcpy() to write past a smaller pooled host-mapped buffer.