CVE-2026-125268
FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in the CineForm HD decoder that allows attackers to leak heap
CVSS
3.3
Baixa
EPSS
—
KEV
—
Exploit Today
0
0-100
Publicado: 9 de nov. de 2026 · Última mod.: 9 de nov. de 2026 · CWE-908
Ainda não há histórico EPSS suficiente.
FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in the CineForm HD decoder that allows attackers to leak heap memory via unzeroed idwt_tmp buffers in libavcodec/cfhd.c. Attackers can supply a crafted CFHD file with an ImageHeight tag exceeding coded band heights, causing uninitialized heap bytes to be filtered into decoded video output.
- code.ffmpeg.orghttps://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25718
- github.comhttps://github.com/FFmpeg/FFmpeg
- github.comhttps://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/cfhd.c#L292
- github.comhttps://github.com/FFmpeg/FFmpeg/commit/0bfa350291b2118f6d590263dc1ee9cea766c0f1
- www.vulncheck.comhttps://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-uninitialized-heap-memory-disclosure-in-cfhd-decoder
CVECVSSEPSSKEVRExploitTítuloMod.
CVE-2026-1252663.3 BAI—
——0FFmpeg through 9.0.2 contains an uninitialized stack memory disclosure vulnerability in old_codec23() of libavcodec/sanm.c that leaks stack bytes into decoded frames. Attackers can supply a crafted LucasArts SMUSH/SANM animation using codec 23 with an inline table to expose decoder process stack memory in output video.4hCVE-2026-1252433.3 BAI—
——0FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in ff_jpegls_decode_picture() in libavcodec/jpeglsdec.c, which decodes 16-bit line-interleaved JPEG-LS scans as 8-bit samples. Attackers can supply a crafted single-component JPEG-LS image with the ILV byte set to 1, causing decoded GRAY16 frames to expose leftover heap memory.5hCVE-2026-1252173.3 BAI—
——0FFmpeg through 9.0.2 contains an uninitialized memory use vulnerability in roq_dpcm_encode_frame() in libavcodec/roqaudioenc.c that encodes stale heap contents when flushed early. Attackers can supply short audio streams under eight frames for RoQ DPCM transcoding, causing DPCM-quantized uninitialized heap data from frame_buffer to leak into output packets.5hCVE-2026-1251952.5 BAI—
——0FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in adpcm_encode_frame() in libavcodec/adpcmenc.c that leaks heap bytes when encoding mono ADPCM_MS audio with trellis enabled. Attackers submitting audio to a service using this encoding receive output packets where about half of each block contains stale heap memory from the encoding process.5hCVE-2026-1251923.3 BAI—
——0FFmpeg through 9.0.2 contains an uninitialized memory vulnerability in the DXA decoder in libavcodec/dxa.c that allows attackers to disclose heap memory via crafted DXA files. Attackers can supply a DXA video with a type 4 frame that copies the uninitialized decomp_buf buffer into output pictures, exposing leftover heap contents in decoded frames.5hCVE-2026-1251903.3 BAI—
——0FFmpeg through 9.0.2 contains an information disclosure vulnerability in decode_mvc2() in libavcodec/mvcdec.c that leaks uninitialized stack memory through unchecked palette indices. Attackers can supply a crafted MVC2 stream declaring few colors but referencing higher palette indices, copying process stack contents into decoded RGB frames.5h