---
id: CVE-2026-125245
title: FFmpeg through 9.0.2 Memory Leak in MJPEG Hwaccel SOF Decoding
summary: >-
  FFmpeg through 9.0.2 contains a memory leak vulnerability in
  ff_mjpeg_decode_sof() in libavcodec/mjpegdec.c, which overwrites the
  hwaccel_picture_private pointer without freeing it. Attackers can supply
  crafted MJPEG streams with repeate…
severity: medium
cvss: 4.7
cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H'
cvssSource: cna
cwe:
  - CWE-401
vendor: FFmpeg
product: FFmpeg
affected:
  - FFmpeg <= 9.0.2
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-09T20:56:07.780785Z'
published: '2026-11-09'
updated: '2026-11-09'
sourceUpdated: '2026-11-09T20:56:49.121Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-125245'
references:
  - url: 'https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25231'
  - url: >-
      https://github.com/FFmpeg/FFmpeg/commit/50e9ef29be1766404115b0a4908fa3fd6ed7fa3f
    label: Patch Commit
  - url: 'https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/mjpegdec.c#L826'
  - url: 'https://github.com/FFmpeg/FFmpeg'
  - url: >-
      https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-memory-leak-in-mjpeg-hwaccel-sof-decoding
    label: >-
      VulnCheck Advisory: FFmpeg through 9.0.2 Memory Leak in MJPEG Hwaccel SOF
      Decoding
tags:
  - cve.org
ingestedAt: '2026-11-09T19:18:02.579Z'
---

## Overview

FFmpeg through 9.0.2 contains a memory leak vulnerability in ff_mjpeg_decode_sof() in libavcodec/mjpegdec.c, which overwrites the hwaccel_picture_private pointer without freeing it. Attackers can supply crafted MJPEG streams with repeated SOF markers or failing frames to leak hwaccel private data and hardware buffers under VAAPI or NVDEC decoding.

## Affected

- `FFmpeg <= 9.0.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.