Bug 2571110 (CVE-2026-125202)
| Summary: | CVE-2026-125202 ffmpeg: FFmpeg: Arbitrary code execution via heap buffer overflow in VAAPI HEVC decoder | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | bbrownin |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in FFmpeg. An attacker could achieve arbitrary code execution or cause a denial of service (DoS) by providing a specially crafted High Efficiency Video Coding (HEVC) video stream. Due to a heap-based buffer overflow in the Video Acceleration API (VAAPI) decoder, unbounded tile information is copied beyond allocated memory boundaries. Applications utilizing VAAPI to decode malicious media streams are subject to heap memory corruption.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
OSIDB Bzimport
2026-11-10 20:41:02 UTC
|