CVE-2026-125098 is an information disclosure vulnerability in FFmpeg versions up to 9.0.2. It occurs in the vp8_lossy_decode_alpha() function in libavcodec/webp.c, where the alpha plane memory is left uninitialized for short uncompressed ALPH chunks in WebP images. This can allow attackers to craft a WebP image with an ALPH chunk shorter than width * height, causing stale pixel data from previously decoded frames to be disclosed.
CVE-2026-125097 is a medium severity vulnerability in FFmpeg through version 9.0.2 involving uninitialized memory disclosure. The flaw exists in the raw_decode() function of libavcodec/rawdec.c, where the code fails to verify that the packet stride covers a full row for 1 to 8 bits per pixel video. This allows attackers to craft AVI, MOV, or NUT files with truncated low bit depth rawvideo packets that can leak uninitialized heap memory through the decoded frame output.
CVE-2026-125096 is a medium severity vulnerability in FFmpeg through version 9.0.2. It involves an uninitialized memory disclosure in the libavcodec/tiertexseqv.c component. An attacker can craft a malicious Tiertex SEQ file that triggers a failed run-length encoding (RLE) unpacking, causing the function seq_decode_op1() to copy uninitialized 64-byte stack memory into decoded frames. This leads to leakage of stack contents in the output video frames.
FFmpeg through 9.0.2 contains an uninitialized memory use vulnerability in the C93 video decoder in libavcodec/c93.c, where decode_frame() never checks how many color table bytes were copied. Attackers can supply a crafted truncated Interplay C93 file so draw_n_color() writes uninitialized stack bytes into decoded frames, disclosing stack memory contents.
FFmpeg through 9.0.2 contains an infinite loop vulnerability in bit_allocation() in libavcodec/imc.c that allows attackers to hang decoding by supplying audio blocks with a negative bit budget. Attackers can craft IMC or IAC audio files that drive freebits negative, causing the reduction loop to never terminate and consuming 100% CPU.
FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in mp_decode_frame() in libavcodec/mpegaudiodec_template.c because init_get_bits() failure is ignored after a signed integer overflow. Attackers can pass an oversized packet to the mp3adu decoder through the libavcodec API, causing reads through a NULL buffer that crash the process.
FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in libavcodec/jvdec.c that allows attackers to crash applications by supplying oversized JV video packets. Attackers can pass a roughly 268435460-byte packet through the libavcodec API, overflowing the bit count so decode_frame() reads from a NULL buffer and causes denial of service.
FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in tqi_decode_frame() in libavcodec/eatqi.c, which ignores init_get_bits() failure after an integer overflow. Attackers can supply a crafted EA file with a pIQT chunk carrying a 2^28-byte payload to crash the process, causing denial of service.
FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in the Motion Pixels decoder because mp_decode_frame() ignores init_get_bits() failure. Attackers supplying a roughly 2^28-byte packet through the libavcodec API overflow the bit count, causing reads from a NULL buffer that crash the process.
FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in the Bink video decoder because decode_frame() in libavcodec/bink.c ignores init_get_bits() failure. Attackers can supply a crafted Bink file with a frame of about 2^28 bytes, overflowing the bit count and crashing the process for denial of service.
FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in vble_decode_frame() in libavcodec/vble.c because it ignores init_get_bits() failure on oversized packets. Attackers can supply a crafted AVI file with a 268435452-byte VBLE frame, causing reads from a NULL bit reader buffer that crash the process.
FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in the Cirrus Logic AccuPak (CLJR) decoder in libavcodec/cljrdec.c because decode_frame() ignores init_get_bits() failure. Attackers can supply a crafted AVI file with a 2^28-byte CLJR frame that overflows the bit count, causing reads from a NULL buffer and crashing the process.
FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in tgv_decode_inter() in libavcodec/eatgv.c that ignores init_get_bits() failure on oversized packets. Attackers can supply a crafted EA file with a kVGT frame followed by an fVGT inter frame with a 2^28-byte compressed block section, crashing the process for denial of service.
FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in g726_decode_frame() in libavcodec/g726.c because it ignores init_get_bits() failure on oversized packets. Attackers can supply a crafted AVI file with a 268435392-byte G.726 audio chunk to make the decoder read from a NULL buffer, crashing the process.
A vulnerability in MIT Kerberos 5's clnttcp_call() function in Red Hat Enterprise Linux 10 causes a memory leak in GSS-RPC client programs by not freeing the RPC reply verifier between retries. This can be exploited by remote attackers who control an RPC endpoint or intercept client network traffic to cause a denial of service through resource exhaustion. The flaw affects client-side RPC processing only and does not impact authentication servers or default daemon operations. Exploitation requires continuous malformed responses during an active transaction and does not compromise data integrity or confidentiality. Red Hat rates this vulnerability as Moderate and currently has no effective mitigation that meets their criteria.
The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) does not free decoded arguments on certain error paths, which allows remote attackers to cause a denial of service (memory exhaustion in kadmind) via crafted AUTH_GSSAPI_INIT requests that trigger authentication failures.
CVE-2026-112320 is a vulnerability in the GSS-RPC transport layer of MIT Kerberos 5 (krb5) 1.4 and later, affecting Red Hat Enterprise Linux 10. It occurs because the system does not release the previous authentication context when a client switches from a GSS authentication flavor to a non-GSS flavor on the same TCP connection. This flaw allows unauthenticated remote attackers to cause a denial of service by exhausting memory in the kadmind service through repeated establishment and abandonment of GSS authentication contexts.
CVE-2026-112319 is a vulnerability in the GSS-RPC layer of MIT Kerberos 5 used in Red Hat Enterprise Linux 10. It allows remote authenticated users to cause a denial of service by triggering unbounded memory allocations during XDR decoding of crafted RPC requests. This leads to memory exhaustion or excessive CPU consumption in the Kerberos administration daemon (kadmind). Exploitation requires valid Kerberos authentication and affects process availability without compromising data confidentiality or integrity.
CVE-2026-112318 is a denial of service vulnerability in the MIT Kerberos 5 kadmind service used in Red Hat Enterprise Linux 10. The flaw occurs because the policy RPC stubs do not reject a NULL policy name, leading to a NULL pointer dereference and crash of the kadmind daemon when a remote authenticated user sends a crafted policy request with an empty policy name. This disrupts administrative operations but does not affect standard ticket-granting or authentication services.
xdr_krb5_tl_data() in lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) does not free partially decoded data on failure, which allows remote authenticated users to cause a denial of service (memory leak in kadmind) via crafted RPC requests that trigger a decode failure.