Threats affecting pkg:generic/espeak-ng

FFmpeg versions up to 9.0.2 contain an out-of-bounds heap read vulnerability in the tdsc_load_cursor() function. This flaw occurs because cursor dimensions are stored before validation, allowing a crafted AVI file with oversized cursor dimensions to cause tdsc_paint_cursor() to read beyond the allocated buffer. This can lead to decoder crashes or leakage of heap memory into video frames.

CVE-2026-125177 is an information disclosure vulnerability in FFmpeg versions up to 9.0.2. It affects the MSCC/SRGC decoder in libavcodec/mscc.c, where uninitialized heap bytes may be output when RLE data ends prematurely. This can cause decoded frames to expose leftover heap memory to viewers of the output.

CVE-2026-125176 is a medium severity vulnerability in FFmpeg versions up to 9.0.2. It involves an uninitialized memory read in the decode_hybrid() function of libavcodec/flashsv.c when decoding 15-bit color pixels in Flash Screen Video 2 blocks. Crafted input can cause heap memory leakage into decoded output frames.

CVE-2026-125175 is an information disclosure vulnerability in FFmpeg versions up to 9.0.2. It occurs in the flashsv_decode_block() function within libavcodec/flashsv.c, where uninitialized heap memory may be copied into decoded frames if the inflate output is shorter than expected. An attacker can exploit this by supplying a crafted FLV file containing an FSV1 stream with zlib block data that decompresses short, potentially allowing recovery of heap contents from the decoded or re-encoded output.

FFmpeg before 8.1.3 and 9.x before 9.0.2 contains a NULL pointer dereference vulnerability in ff_hap_set_chunk_count() in libavcodec/hap.c, where a shadowed return variable masks reallocation failures. Attackers can supply a crafted Hap video frame with an oversized chunk count so the decoder writes through a NULL chunk table, crashing the application.

FFmpeg through 9.0.2 contains a memory leak vulnerability in libxevd_receive_frame() in libavcodec/libxevd.c that fails to free pkt_au when an access unit produces no picture. Attackers can supply a crafted EVC stream with many access units containing only parameter sets or non-frame NAL units to exhaust memory in the decoding application.

CVE-2026-125172 is an out-of-bounds read vulnerability in FFmpeg versions 7.0 through 9.0.2. The flaw exists in the libxevd_receive_frame() function within libavcodec/libxevd.c, where the code does not properly validate NAL unit length prefixes against the remaining packet data. Maliciously crafted EVC media with oversized 4-byte NAL length prefixes can cause libxevd to read beyond the packet buffer, potentially crashing the application or exposing adjacent heap memory.

An out-of-bounds read vulnerability exists in FFmpeg versions up to 9.0.2 in the Musepack SV7 decoder. The function mpc7_decode_init() fails to validate the last frame length against the expected frame size, allowing crafted files to cause reads beyond the audio buffer. This can lead to application crashes or disclosure of heap memory contents.

CVE-2026-125170 is a medium severity vulnerability in FFmpeg up to version 9.0.2 involving uninitialized memory disclosure in the targa_decode_rle() function. The flaw arises from missing packet length checks when decoding RLE-compressed TGA images, allowing attackers to supply truncated images that cause decoded frames to contain leftover heap buffer data and replicated uninitialized stack bytes.

FFmpeg through 9.0.2 contains a memory exhaustion vulnerability in ape_decode_frame() in libavcodec/apedec.c that fails to enforce the 73728-sample limit for legacy APE frames. Attackers can supply a crafted legacy Monkey's Audio file declaring an enormous nblocks value to force gigabyte-scale allocations and cause denial of service.

CVE-2026-125103 is an information disclosure vulnerability in FFmpeg versions up to 9.0.2. It occurs in the ff_mlz_decompression() function within libavcodec/mlz.c, where malformed MPEG-4 ALS files with out-of-range codes can cause uninitialized heap bytes to be copied into decoded audio output. This can lead to unintended disclosure of memory contents.

FFmpeg versions up to 9.0.2 have a vulnerability in the tak_decode_frame() function where uninitialized memory can be disclosed. This occurs because the function does not verify that multichannel decorrelation lists cover every audio channel, allowing crafted TAK files to cause heap memory leaks through undecoded audio samples.

CVE-2026-125101 is an information disclosure vulnerability in FFmpeg versions up to 9.0.2. It affects the VMnc decoder in libavcodec/vmnc.c, where an uninitialized cursor save area can be restored into later frames. This can cause uninitialized heap bytes to appear in decoded output when processing a crafted VMnc stream.

FFmpeg versions up to 9.0.2 contain an integer overflow vulnerability in the OpenEXR decoder's decode_frame() function. This flaw miscalculates the tiled block count when processing crafted OpenEXR images with large dimensions and small tiles. Exploitation can lead to skipping decoding steps and potentially disclosing uninitialized memory or stale frame data.

FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in the GEM raster image decoder in libavcodec/gemdec.c that exposes uninitialized row-buffer bytes. Attackers can supply a crafted GEM .img image using SKIP or pattern opcodes to copy uninitialized heap memory into decoded frames, disclosing heap contents.

CVE-2026-125098 is an information disclosure vulnerability in FFmpeg versions up to 9.0.2. It occurs in the vp8_lossy_decode_alpha() function in libavcodec/webp.c, where the alpha plane memory is left uninitialized for short uncompressed ALPH chunks in WebP images. This can allow attackers to craft a WebP image with an ALPH chunk shorter than width * height, causing stale pixel data from previously decoded frames to be disclosed.

CVE-2026-125097 is a medium severity vulnerability in FFmpeg through version 9.0.2 involving uninitialized memory disclosure. The flaw exists in the raw_decode() function of libavcodec/rawdec.c, where the code fails to verify that the packet stride covers a full row for 1 to 8 bits per pixel video. This allows attackers to craft AVI, MOV, or NUT files with truncated low bit depth rawvideo packets that can leak uninitialized heap memory through the decoded frame output.

CVE-2026-125096 is a medium severity vulnerability in FFmpeg through version 9.0.2. It involves an uninitialized memory disclosure in the libavcodec/tiertexseqv.c component. An attacker can craft a malicious Tiertex SEQ file that triggers a failed run-length encoding (RLE) unpacking, causing the function seq_decode_op1() to copy uninitialized 64-byte stack memory into decoded frames. This leads to leakage of stack contents in the output video frames.

FFmpeg through 9.0.2 contains an uninitialized memory use vulnerability in the C93 video decoder in libavcodec/c93.c, where decode_frame() never checks how many color table bytes were copied. Attackers can supply a crafted truncated Interplay C93 file so draw_n_color() writes uninitialized stack bytes into decoded frames, disclosing stack memory contents.

FFmpeg through 9.0.2 contains an infinite loop vulnerability in bit_allocation() in libavcodec/imc.c that allows attackers to hang decoding by supplying audio blocks with a negative bit budget. Attackers can craft IMC or IAC audio files that drive freebits negative, causing the reduction loop to never terminate and consuming 100% CPU.