Threats affecting pkg:generic/espeak-ng

CVE-2026-125255 is a use-after-free vulnerability in FFmpeg versions up to 9.0.2. It occurs in the MJPEG decoder component when processing crafted MJPEG streams containing a Start of Frame (SOF) marker without a preceding Start of Image (SOI) marker. This flaw can cause the decoder to use a stale pointer, potentially leading to application crashes or heap memory disclosure.

FFmpeg through 9.0.2 contains a division by zero vulnerability in the VVC decoder because ff_vvc_slice_rpl() fails to validate num_ref_idx_active against built reference list entries. Attackers can supply a crafted VVC bitstream whose excess reference indices yield a zero POC difference in ff_vvc_mv_scale(), crashing the decoding process.

CVE-2026-125253 is an integer overflow vulnerability in FFmpeg versions up to 9.0.2 affecting 32-bit builds. The flaw exists in the cbs_vp9_split_fragment() function within libavcodec/cbs_vp9.c, where a crafted VP9 packet with a forged superframe index can cause an integer overflow leading to out-of-bounds reads and application crashes.

FFmpeg through 9.0.2 contains a memory leak vulnerability in libavcodec/vaapi_decode.c that allows attackers to exhaust memory by supplying streams with slice parse errors. Attackers can craft H.264 or other VAAPI-decoded video where later slices fail to parse on every frame, continuously leaking VA parameter and slice buffers plus driver and heap memory.

FFmpeg versions up to 9.0.2 contain an integer overflow vulnerability in the VVC decoder's alloc_frame() function on 32-bit builds. This flaw causes undersized allocation of the reference picture list, allowing crafted VVC (H.266) files with many NAL units to trigger heap out-of-bounds writes and memory corruption.

CVE-2026-125250 is a heap-based buffer overflow vulnerability in FFmpeg versions up to 9.0.2. It occurs in the GIF encoder's gif_image_write_image() function due to incorrect sizing of an internal buffer based on the first frame's linesize. Attackers can exploit this by providing PAL8 video with a frame linesize that increases mid-stream, leading to out-of-bounds writes and heap corruption during GIF transcoding.

CVE-2026-125249 is an integer overflow vulnerability in FFmpeg versions 7.1 through 9.0.2 within the Vulkan hardware acceleration decoding component. The flaw occurs in the ff_vk_decode_add_slice() function, which miscalculates the bitstream buffer size, allowing an attacker to supply a crafted stream with over 2 GiB of slice data per frame. This can cause a buffer overflow via memcpy() writing beyond the allocated buffer.

FFmpeg versions 9.0 through 9.0.2 contain an integer overflow vulnerability in the Vulkan encoder component. This flaw causes undersizing of the float remap GPU buffer for large frames, which can lead to out-of-bounds GPU memory writes when processing certain large image or video formats. Exploitation may result in crashes or memory corruption during transcoding.

CVE-2026-125247 is an integer overflow vulnerability in FFmpeg versions up to 9.0.2. It occurs in the dng_decode_tiles() function when processing crafted DNG tile dimensions, allowing attackers to leak uninitialized or stale heap memory by setting TileWidth or TileLength near the integer maximum value. This can cause the tile loop to never run, resulting in memory exposure.

FFmpeg through 9.0.2 contains a denial of service vulnerability in cbs_jpeg_assemble_fragment() that miscounts 0xff stuffing bytes in JPEG scan headers. Attackers can supply a crafted JPEG/MJPEG stream with 0xff in the scan header, triggering an av_assert0 abort when CBS-based bitstream filters process it.

FFmpeg through 9.0.2 contains a memory leak vulnerability in ff_mjpeg_decode_sof() in libavcodec/mjpegdec.c, which overwrites the hwaccel_picture_private pointer without freeing it. Attackers can supply crafted MJPEG streams with repeated SOF markers or failing frames to leak hwaccel private data and hardware buffers under VAAPI or NVDEC decoding.

CVE-2026-125244 is an out-of-bounds write vulnerability in FFmpeg's VVC decoder affecting versions before 8.1.3 and 9.x before 9.0.2. The flaw occurs in the sh_entry_points() function when processing crafted VVC (H.266) bitstreams with specific SPS/PPS tile and WPP layouts, leading to memory corruption in the decoder.

CVE-2026-125243 is a medium severity vulnerability in FFmpeg up to version 9.0.2. It involves an uninitialized memory disclosure in the JPEG-LS decoder component, specifically in ff_jpegls_decode_picture(). A crafted single-component JPEG-LS image with the ILV byte set to 1 can cause decoded GRAY16 frames to leak leftover heap memory.

FFmpeg through 9.0.2 contains a memory leak vulnerability in libavcodec/vdpau.c that allows attackers to exhaust heap memory by aborting pictures before end_frame. Attackers can supply crafted H.264 streams with malformed NAL units that repeatedly abandon pictures, leaking the bitstream_buffers table continuously and causing denial of service.

CVE-2026-125241 is a heap buffer overflow vulnerability in FFmpeg versions up to 9.0.2. It occurs in the libavcodec/flicvideo.c component due to insufficient bounds checking in the check_pixel_ptr() function when processing negative-stride frames. An attacker can craft a malicious FLIC file with specially designed RLE and delta chunks that write pixel data beyond allocated frame storage, leading to heap memory corruption. This can cause application crashes or potentially allow code execution.

FFmpeg through 9.0.2 contains a resource leak vulnerability in svt_jpegxs_dec_decode() in libsvtjpegxsdec.c that leaks decoder instances when ff_set_dimensions() rejects frame dimensions. Attackers can supply a crafted JPEG XS stream, for example in MPEG-TS, with oversized headers to repeatedly leak decoder threads and buffers, exhausting memory.

CVE-2026-125239 is a heap buffer overflow vulnerability in FFmpeg versions up to 9.0.2. It occurs in the function ff_dxva2_hevc_fill_picture_parameters() when processing HEVC bitstreams with many non-uniformly spaced tiles. This flaw allows attackers to corrupt memory by writing controlled 16-bit values beyond fixed-size DXVA arrays during hardware-accelerated video decoding on Windows platforms.

FFmpeg through 9.0.2 contains a reachable assertion vulnerability in libxevd_receive_frame() in libavcodec/libxevd.c that returns success when an access unit produces no frame. Attackers can supply a crafted EVC file with truncated or picture-less access units to trigger the av_assert0() on frame->private_ref, aborting any decoding application.

FFmpeg 8.1 through 9.0.2 contains a denial of service vulnerability in libavcodec/dpx.c that leaves dpx->hwaccel_picture_private allocated when Vulkan hwaccel callbacks fail. Attackers can supply crafted DPX images that make start_frame, decode_slice or end_frame fail, triggering an av_assert0 abort on the next frame and terminating the decoding application.

CVE-2026-125236 is a memory leak vulnerability in FFmpeg versions up to 9.0.2. It occurs in the alloc_frame() function within libavcodec/vvc/refs.c, where SPS and PPS references are not released properly when frame buffer allocation fails. An attacker can exploit this by supplying a crafted VVC (H.266) video stream that repeatedly replaces parameter sets, causing memory usage to grow steadily and potentially leading to denial of service.