FFmpeg vulnerabilities and threats

CVE-2026-125190 is an information disclosure vulnerability in FFmpeg versions up to 9.0.2. It occurs in the decode_mvc2() function of libavcodec/mvcdec.c, where uninitialized stack memory can be leaked through unchecked palette indices. An attacker can craft an MVC2 stream that declares few colors but references higher palette indices, causing process stack contents to be copied into decoded RGB frames.

FFmpeg versions 8.1 through 9.0.2 contain a denial of service vulnerability in the lcevc_metadata bitstream filter. This flaw is due to a process block position mismatch in the function lcevc_metadata_handle_vui(), which can be triggered by specially crafted LCEVC access units containing two IDR or non-IDR NAL units. Exploitation causes an assertion failure leading to application abort.

CVE-2026-125188 is a heap out-of-bounds read vulnerability in FFmpeg versions up to 9.0.2. It occurs in the prores_aw encoder when processing interlaced video frames with odd heights, causing memory before a buffer to be read and leaked into the encoded output. This flaw can lead to unintended disclosure of heap memory contents.

CVE-2026-125187 is a reachable assertion vulnerability in FFmpeg versions up to 9.0.2 affecting the TTA encoder. The flaw occurs because the encoder does not reserve output packet space for a 4-byte CRC, which can cause an assertion failure and abort the transcoding process when processing certain audio inputs.

CVE-2026-125186 is a resource exhaustion vulnerability in FFmpeg versions up to 9.0.2. It affects the dts2pts bitstream filter, where attackers can craft H.264 packets with many slices having alternating picture order counts. This causes the h264_queue_frame() function to allocate excessive tree nodes per slice, leading to CPU exhaustion and potential denial of service.

A division by zero vulnerability exists in FFmpeg versions up to 9.0.2 in the function ff_aom_parse_film_grain_sets(). This flaw occurs when the decoder processes crafted HEVC or VVC files containing zero-increment scaling points in T.35 SEI messages, leading to a crash.

FFmpeg versions 6.1 through 9.0.2 have an information disclosure vulnerability in the CamStudio decoder (libavcodec/cscd.c). This flaw occurs when the decompressed payloads of LZO or zlib frames are shorter than the expected frame size, causing uninitialized heap memory to be copied into decoded frames. An attacker can exploit this by supplying a crafted AVI file with a CSCD stream to recover heap contents from the decoded or re-encoded output.

CVE-2026-125183 is a denial of service vulnerability in FFmpeg versions up to 9.0.2. It occurs in the pps_3d_extension() function within libavcodec/hevc/ps.c, where crafted HEVC files with repeated PPS NAL units cause excessive iteration and CPU exhaustion. This leads to stalling of decoders, parsers, and the ffprobe tool.

CVE-2026-125182 is an out-of-bounds read vulnerability in FFmpeg versions up to 9.0.2. It occurs in the Cook decoder's joint_decode() function due to insufficient validation of the js_subband_start parameter during initialization. A crafted RealMedia file can trigger reads beyond the intended buffer, potentially leaking pointers and decoder state information that could aid in bypassing address space layout randomization (ASLR).

CVE-2026-125181 is an out-of-bounds write vulnerability in FFmpeg versions up to 9.0.2 affecting the flic_decode_frame_15_16BPP() function. It occurs on big-endian systems when processing crafted 15/16 bpp FLIC/FLX files containing a malicious FLI_BRUN chunk. This vulnerability can lead to heap memory corruption and process crashes.

A memory exhaustion vulnerability exists in FFmpeg versions 8.1 through 9.0.2 in the libavcodec/exif.c parser. This flaw allows attackers to craft EXIF blocks in image files (TIFF, JPEG, PNG, WebP) that cause quadratic memory allocation by referencing overlapping payloads. Successful exploitation can lead to denial of service in applications decoding these images.

CVE-2026-125179 is a medium severity vulnerability in FFmpeg versions up to 9.0.2. It involves an uninitialized memory issue in the VQA video decoder, where crafted VQA files can cause heap memory disclosure by omitting or truncating a specific codebook chunk. This leads to leftover heap bytes being rendered in decoded video frames.

FFmpeg versions up to 9.0.2 contain an out-of-bounds heap read vulnerability in the tdsc_load_cursor() function. This flaw occurs because cursor dimensions are stored before validation, allowing a crafted AVI file with oversized cursor dimensions to cause tdsc_paint_cursor() to read beyond the allocated buffer. This can lead to decoder crashes or leakage of heap memory into video frames.

CVE-2026-125177 is an information disclosure vulnerability in FFmpeg versions up to 9.0.2. It affects the MSCC/SRGC decoder in libavcodec/mscc.c, where uninitialized heap bytes may be output when RLE data ends prematurely. This can cause decoded frames to expose leftover heap memory to viewers of the output.

CVE-2026-125176 is a medium severity vulnerability in FFmpeg versions up to 9.0.2. It involves an uninitialized memory read in the decode_hybrid() function of libavcodec/flashsv.c when decoding 15-bit color pixels in Flash Screen Video 2 blocks. Crafted input can cause heap memory leakage into decoded output frames.

CVE-2026-125175 is an information disclosure vulnerability in FFmpeg versions up to 9.0.2. It occurs in the flashsv_decode_block() function within libavcodec/flashsv.c, where uninitialized heap memory may be copied into decoded frames if the inflate output is shorter than expected. An attacker can exploit this by supplying a crafted FLV file containing an FSV1 stream with zlib block data that decompresses short, potentially allowing recovery of heap contents from the decoded or re-encoded output.

CVE-2026-125174 is a vulnerability in FFmpeg versions before 8.1.3 and 9.x before 9.0.2. It involves a NULL pointer dereference in the function ff_hap_set_chunk_count() within libavcodec/hap.c due to a shadowed return variable that masks reallocation failures. An attacker can exploit this by providing a crafted Hap video frame with an oversized chunk count, causing the decoder to write through a NULL chunk table and crash the application.

CVE-2026-125173 is a memory leak vulnerability in FFmpeg versions 7.0 through 9.0.2. The flaw exists in the libxevd_receive_frame() function within libavcodec/libxevd.c, where memory allocated for pkt_au is not freed when an access unit produces no picture. An attacker can exploit this by supplying a crafted EVC stream with many access units containing only parameter sets or non-frame NAL units, potentially exhausting memory in the decoding application.

CVE-2026-125172 is an out-of-bounds read vulnerability in FFmpeg versions 7.0 through 9.0.2. The flaw exists in the libxevd_receive_frame() function within libavcodec/libxevd.c, where the code does not properly validate NAL unit length prefixes against the remaining packet data. Maliciously crafted EVC media with oversized 4-byte NAL length prefixes can cause libxevd to read beyond the packet buffer, potentially crashing the application or exposing adjacent heap memory.

An out-of-bounds read vulnerability exists in FFmpeg versions up to 9.0.2 in the Musepack SV7 decoder. The function mpc7_decode_init() fails to validate the last frame length against the expected frame size, allowing crafted files to cause reads beyond the audio buffer. This can lead to application crashes or disclosure of heap memory contents.