CVE-2026-125237
MEDIUM
NVD
CVSS Score
4.7
Severity
MEDIUM
Published
Nov 09, 2026
Vendor
unknown
Description
FFmpeg 8.1 through 9.0.2 contains a denial of service vulnerability in libavcodec/dpx.c that leaves dpx->hwaccel_picture_private allocated when Vulkan hwaccel callbacks fail. Attackers can supply crafted DPX images that make start_frame, decode_slice or end_frame fail, triggering an av_assert0 abort on the next frame and terminating the decoding application.