CVE-2026-125237 FFmpeg 8.1 through 9.0.2 Denial of Service via DPX Vulkan Hwaccel Error Path

FFmpeg 8.1 through 9.0.2 contains a denial of service vulnerability in libavcodec/dpx.c that leaves dpx-hwaccelpictureprivate allocated when Vulkan hwaccel callbacks fail. Attackers can supply crafted DPX images that make startframe, decodeslice or endframe fail, triggering an avassert0 abort on...

CVE-2026-125237

FFmpeg versions 8.1 through 9.0.2 are affected by a denial of service vulnerability located in libavcodec/dpx.c . The issue occurs because dpx->hwaccel_picture_private remains allocated when Vulkan hardware acceleration callbacks fail. An attacker can provide crafted DPX images that cause star...

PT-2026-141077

FFmpeg 7.1 through 9.0.2 contains an integer overflow in ff vk decode add slice in libavcodec/vulkan decode.c that miscalculates the Vulkan hwaccel bitstream buffer size. Attackers can supply a crafted stream with over 2 GiB of slice data per frame, causing memcpy to write past a smaller pooled...

CVE-2026-125237: FFmpeg: FFmpeg 8.1 through 9.0.2 contains a denial of service vulnerability in libavcodec/dpx.c that leaves…

FFmpeg 8.1 through 9.0.2 contains a denial of service vulnerability in libavcodec/dpx.c that leaves dpx-hwaccelpictureprivate allocated when Vulkan hwaccel callbacks fail. Attackers can supply crafted DPX images that make startframe, decodeslice or endframe fail, triggering an avassert0 abort on...

PT-2026-141065

FFmpeg 8.1 through 9.0.2 contains a denial of service vulnerability in libavcodec/dpx.c that leaves dpx-hwaccel picture private allocated when Vulkan hwaccel callbacks fail. Attackers can supply crafted DPX images that make start frame, decode slice or end frame fail, triggering an av assert0 abo...