Threats affecting pkg:generic/espeak-ng

CVE-2026-125198 is a memory leak vulnerability in FFmpeg versions up to 9.0.2. It occurs in the mediaformat_jni_setBuffer() function within libavcodec/mediacodec_wrapper.c, where buffers created with NewDirectByteBuffer() are not freed. This flaw allows attackers to cause native memory exhaustion by supplying crafted media files with large extradata to Android applications using MediaCodec decoders.

CVE-2026-125197 is an integer underflow vulnerability in FFmpeg up to version 9.0.2. It occurs in the decode_frame() function of libavcodec/lcldec.c and allows attackers to cause a heap out-of-bounds read by supplying crafted short ZLIB packets with the FLAG_MULTITHREAD flag. This can be triggered by a malicious AVI or MKV file containing an LCL video stream with packets shorter than 8 bytes, bypassing length clamping and potentially crashing the decoding application.

CVE-2026-125196 is a heap-based buffer overflow vulnerability in FFmpeg versions 8.0 through 9.0.2. It occurs in the liboapve_encode() function within libavcodec/liboapvenc.c when processing video frames larger than the configured encoder dimensions. This flaw allows attackers to corrupt heap memory by crafting videos with resolution changes mid-stream, causing transcoding to APV without rescaling to write attacker-controlled pixel data beyond allocated buffers.

CVE-2026-125195 is a low-severity vulnerability in FFmpeg versions up to 9.0.2. It involves an uninitialized memory disclosure in the adpcm_encode_frame() function when encoding mono ADPCM_MS audio with trellis enabled. This flaw causes output packets to leak stale heap memory, potentially exposing sensitive data from the encoding process.

FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in pcm_dvd_encode_frame() in libavcodec/pcm-dvdenc.c when a 24-bit final frame holds fewer samples than one block. Attackers can supply 24-bit 48 or 96 kHz audio whose length leaves a short final frame, causing the loop counter to wrap and crash the transcoding process.

CVE-2026-125193 is an out-of-bounds read vulnerability in FFmpeg versions up to 9.0.2. It occurs in the bitpacked_decode_uyvy422() function due to lack of verification that packets contain sufficient data. Crafted truncated bitpacked UYVY422 packets can cause application crashes or memory exposure.

CVE-2026-125192 is a medium severity vulnerability in FFmpeg up to version 9.0.2. It involves an uninitialized memory issue in the DXA decoder component, where crafted DXA video files with a specific frame type can cause uninitialized heap memory to be copied into output frames, potentially leaking sensitive data.

FFmpeg through 9.0.2 contains a reference count leak in libavcodec/v4l2_buffers.c that allows attackers to deadlock the V4L2 mem2mem decoder on multi-plane capture formats. Attackers can supply crafted H.264, HEVC, or VP9 streams with resolution changes, making ff_v4l2_m2m_codec_reinit() wait forever and hang the decoding application.

CVE-2026-125190 is an information disclosure vulnerability in FFmpeg versions up to 9.0.2. It occurs in the decode_mvc2() function of libavcodec/mvcdec.c, where uninitialized stack memory can be leaked through unchecked palette indices. An attacker can craft an MVC2 stream that declares few colors but references higher palette indices, causing process stack contents to be copied into decoded RGB frames.

FFmpeg 8.1 through 9.0.2 contains a denial of service vulnerability in the lcevc_metadata bitstream filter caused by a process block position mismatch in lcevc_metadata_handle_vui(). Attackers can supply crafted LCEVC access units with two IDR or non-IDR NAL units to trigger an av_assert0 failure in ff_cbs_lcevc_list_add(), aborting the application.

CVE-2026-125188 is a heap out-of-bounds read vulnerability in FFmpeg versions up to 9.0.2. It occurs in the prores_aw encoder when processing interlaced video frames with odd heights, causing memory before a buffer to be read and leaked into the encoded output. This flaw can lead to unintended disclosure of heap memory contents.

FFmpeg through 9.0.2 contains a reachable assertion vulnerability in the TTA encoder's tta_encode_frame() in libavcodec/ttaenc.c, which never reserves output packet space for the 4-byte CRC. Attackers can supply audio whose sample values and length produce a small, poorly compressible final frame, triggering the av_assert0() in flush_put_bits() and aborting applications transcoding to TTA.

FFmpeg through 9.0.2 contains an uncontrolled resource consumption vulnerability in the dts2pts bitstream filter that allows attackers to exhaust CPU through unbounded per-packet POC node allocation. Attackers can supply a crafted H.264 packet with many slices of alternating picture order counts, forcing h264_queue_frame() to allocate tree nodes per slice and deny service.

FFmpeg through 9.0.2 contains a division by zero vulnerability in ff_aom_parse_film_grain_sets() that fails to reject AFGS1 scaling points with repeated x values. Attackers can supply crafted HEVC or VVC files with zero-increment scaling points in T.35 SEI messages, causing generate_scaling() to divide by zero and crash the decoder.

FFmpeg versions 6.1 through 9.0.2 have an information disclosure vulnerability in the CamStudio decoder (libavcodec/cscd.c). This flaw occurs when the decompressed payloads of LZO or zlib frames are shorter than the expected frame size, causing uninitialized heap memory to be copied into decoded frames. An attacker can exploit this by supplying a crafted AVI file with a CSCD stream to recover heap contents from the decoded or re-encoded output.

FFmpeg through 9.0.2 contains a denial of service vulnerability in pps_3d_extension() in libavcodec/hevc/ps.c that allows attackers to exhaust CPU through unbounded depth lookup table loops. Attackers can supply crafted HEVC files with repeated PPS NAL units that trigger hundreds of millions of bit skips, stalling decoders, parsers, and ffprobe.

CVE-2026-125182 is an out-of-bounds read vulnerability in FFmpeg versions up to 9.0.2. It occurs in the Cook decoder's joint_decode() function due to insufficient validation of the js_subband_start parameter during initialization. A crafted RealMedia file can trigger reads beyond the intended buffer, potentially leaking pointers and decoder state information that could aid in bypassing address space layout randomization (ASLR).

CVE-2026-125181 is an out-of-bounds write vulnerability in FFmpeg versions up to 9.0.2 affecting the flic_decode_frame_15_16BPP() function. It occurs on big-endian systems when processing crafted 15/16 bpp FLIC/FLX files containing a malicious FLI_BRUN chunk. This vulnerability can lead to heap memory corruption and process crashes.

FFmpeg 8.1 through 9.0.2 contains a memory exhaustion vulnerability in the libavcodec/exif.c parser that allows attackers to amplify allocations by pointing many IFD entries at overlapping payloads. Attackers can embed a small crafted EXIF block in TIFF, JPEG, PNG or WebP images to trigger quadratic memory allocation, causing denial of service in decoding applications.

CVE-2026-125179 is a medium severity vulnerability in FFmpeg versions up to 9.0.2. It involves an uninitialized memory issue in the VQA video decoder, where crafted VQA files can cause heap memory disclosure by omitting or truncating a specific codebook chunk. This leads to leftover heap bytes being rendered in decoded video frames.