CVE-2026-125191

MediumCVSS 4.7/10Last modified Nov 10, 2026

Description

FFmpeg through 9.0.2 contains a reference count leak in libavcodec/v4l2_buffers.c that allows attackers to deadlock the V4L2 mem2mem decoder on multi-plane capture formats. Attackers can supply crafted H.264, HEVC, or VP9 streams with resolution changes, making ff_v4l2_m2m_codec_reinit() wait forever and hang the decoding application.

Metrics

CVSS 3.1 4.7/10CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-911

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
FFmpeg	FFmpeg	<= 9.0.2

References

Timeline

Published: Nov 9, 2026
Last modified: Nov 10, 2026
NVD status: Undergoing Analysis

Related CVEs from 2026

CVE-2026-1251923.3FFmpeg through 9.0.2 contains an uninitialized memory vulnerability in the DXA decoder in libavcodec/dxa.c that allows attackers to disclose CVE-2026-1251936.1FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in bitpacked_decode_uyvy422() in libavcodec/bitpacked_dec.c because it nev CVE-2026-1251945.5FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in pcm_dvd_encode_frame() in libavcodec/pcm-dvdenc.c when a 24-bit final f CVE-2026-1251952.5FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in adpcm_encode_frame() in libavcodec/adpcmenc.c that leaks h CVE-2026-1251967.0FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in liboapve_encode() in libavcodec/liboapvenc.c that allows attackers to CVE-2026-1251976.1FFmpeg through 9.0.2 contains an integer underflow in decode_frame() in libavcodec/lcldec.c that allows attackers to trigger a heap out-of-b CVE-2026-1251982.5FFmpeg through 9.0.2 contains a memory leak vulnerability in mediaformat_jni_setBuffer() in libavcodec/mediacodec_wrapper.c that never frees CVE-2026-1251995.5FFmpeg through 9.0.2 contains a memory leak vulnerability in vc1_decode_frame() in libavcodec/vc1dec.c that leaks slice buffers when init_ge CVE-2026-12526.4The Events Listing Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Event URL' parameter in all versions up CVE-2026-125206.4The Sierra Wireless HL7800 cellular modem driver (drivers/modem/vendor_standalone/hl7800.c, located at drivers/modem/hl7800.c in v4.4.0 and CVE-2026-1252005.5FFmpeg through 9.0.2 contains a memory leak vulnerability in libavcodec/libx265.c because libx265_encode_frame() never frees the rpu.payload CVE-2026-1252017.0FFmpeg 7.0 before 8.1.3 and 9.x before 9.0.2 contains a heap out-of-bounds write vulnerability in vk_av1_decode_slice() in libavcodec/vulkan