GHSA-qjxq-q85p-hv2cHighCVSS 7.0
FFmpeg 7.1 through 9.0.2 contains an integer overflow in ff_vk_decode_add_slice() in libavcodec...
🔗 CVE IDs covered (1)
📋 Description
FFmpeg 7.1 through 9.0.2 contains an integer overflow in ff_vk_decode_add_slice() in libavcodec/vulkan_decode.c that miscalculates the Vulkan hwaccel bitstream buffer size. Attackers can supply a crafted stream with over 2 GiB of slice data per frame, causing memcpy() to write past a smaller pooled host-mapped buffer.
🔗 References (6)
- https://nvd.nist.gov/vuln/detail/CVE-2026-125249
- https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25136
- https://github.com/FFmpeg/FFmpeg
- https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/vulkan_decode.c#L345
- https://www.vulncheck.com/advisories/ffmpeg-7.1-through-9.0.2-heap-out-of-bounds-write-via-vulkan-slice-buffer-sizing
- https://github.com/advisories/GHSA-qjxq-q85p-hv2c