CVE-2026-125195
FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in adpcm_encode_frame() in libavcodec/adpcmenc.c that leaks h
CVSS
2.5
Low
EPSS
—
KEV
—
Exploit Today
0
0-100
Published: Nov 9, 2026 · Last modified: Nov 9, 2026 · CWE-908
Not enough EPSS history yet.
FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in adpcm_encode_frame() in libavcodec/adpcmenc.c that leaks heap bytes when encoding mono ADPCM_MS audio with trellis enabled. Attackers submitting audio to a service using this encoding receive output packets where about half of each block contains stale heap memory from the encoding process.
- code.ffmpeg.orghttps://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25694
- github.comhttps://github.com/FFmpeg/FFmpeg
- github.comhttps://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/adpcmenc.c#L785
- github.comhttps://github.com/FFmpeg/FFmpeg/commit/fb13409aaffc151f602ad357db46052e98ea46e8
- www.vulncheck.comhttps://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-uninitialized-memory-disclosure-via-adpcm-ms-trellis-encoding
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-1252683.3 LOW—
——0FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in the CineForm HD decoder that allows attackers to leak heap memory via unzeroed idwt_tmp buffers in libavcodec/cfhd.c. Attackers can supply a crafted CFHD file with an ImageHeight tag exceeding coded band heights, causing uninitialized heap bytes to be filtered into decoded video output.4hCVE-2026-1252663.3 LOW—
——0FFmpeg through 9.0.2 contains an uninitialized stack memory disclosure vulnerability in old_codec23() of libavcodec/sanm.c that leaks stack bytes into decoded frames. Attackers can supply a crafted LucasArts SMUSH/SANM animation using codec 23 with an inline table to expose decoder process stack memory in output video.4hCVE-2026-1252433.3 LOW—
——0FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in ff_jpegls_decode_picture() in libavcodec/jpeglsdec.c, which decodes 16-bit line-interleaved JPEG-LS scans as 8-bit samples. Attackers can supply a crafted single-component JPEG-LS image with the ILV byte set to 1, causing decoded GRAY16 frames to expose leftover heap memory.5hCVE-2026-1252173.3 LOW—
——0FFmpeg through 9.0.2 contains an uninitialized memory use vulnerability in roq_dpcm_encode_frame() in libavcodec/roqaudioenc.c that encodes stale heap contents when flushed early. Attackers can supply short audio streams under eight frames for RoQ DPCM transcoding, causing DPCM-quantized uninitialized heap data from frame_buffer to leak into output packets.5hCVE-2026-1251923.3 LOW—
——0FFmpeg through 9.0.2 contains an uninitialized memory vulnerability in the DXA decoder in libavcodec/dxa.c that allows attackers to disclose heap memory via crafted DXA files. Attackers can supply a DXA video with a type 4 frame that copies the uninitialized decomp_buf buffer into output pictures, exposing leftover heap contents in decoded frames.5hCVE-2026-1251903.3 LOW—
——0FFmpeg through 9.0.2 contains an information disclosure vulnerability in decode_mvc2() in libavcodec/mvcdec.c that leaks uninitialized stack memory through unchecked palette indices. Attackers can supply a crafted MVC2 stream declaring few colors but referencing higher palette indices, copying process stack contents into decoded RGB frames.5h