FFmpeg up to 9.0.2 MJPEG Decoder libavcodec/mjpegdec.c ff_mjpeg_decode_sof raw_image_buffer use after free

Summaryinfo

A vulnerability categorized as critical has been discovered in FFmpeg up to 9.0.2. Affected is the function ff_mjpeg_decode_sof of the file libavcodec/mjpegdec.c of the component MJPEG Decoder. Such manipulation of the argument raw_image_buffer leads to use after free. This vulnerability is uniquely identified as CVE-2026-125255. The attack can be launched remotely. No exploit exists.

Detailsinfo

A vulnerability was found in FFmpeg up to 9.0.2. It has been rated as critical. Affected by this issue is the function ff_mjpeg_decode_sof of the file libavcodec/mjpegdec.c of the component MJPEG Decoder. The manipulation of the argument raw_image_buffer with an unknown input leads to a use after free vulnerability. Using CWE to declare the problem leads to CWE-416. The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer. Impacted is confidentiality, integrity, and availability. CVE summarizes:

FFmpeg through 9.0.2 contains a use after free vulnerability in libavcodec/mjpegdec.c that allows attackers to trigger freed buffer reads by sending a SOF marker without a preceding SOI. Attackers can supply crafted MJPEG streams causing ff_mjpeg_decode_sof() to pass a stale raw_image_buffer pointer to hwaccel decoders like NVDEC, crashing applications or leaking heap contents.

The advisory is available at code.ffmpeg.org. This vulnerability is handled as CVE-2026-125255 since 11/09/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. Technical details are known, but there is no available exploit. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 11/09/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Multimedia Processing Software

Name

• FFmpeg

Version

• 9.0.0
• 9.0.1
• 9.0.2

License

• open-source

Website

• Product: https://ffmpeg.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion