FFmpeg vulnerabilities and threats

CVE-2026-125170 is a medium severity vulnerability in FFmpeg up to version 9.0.2 involving uninitialized memory disclosure in the targa_decode_rle() function. The flaw arises from missing packet length checks when decoding RLE-compressed TGA images, allowing attackers to supply truncated images that cause decoded frames to contain leftover heap buffer data and replicated uninitialized stack bytes.

FFmpeg through 9.0.2 contains a memory exhaustion vulnerability in ape_decode_frame() in libavcodec/apedec.c that fails to enforce the 73728-sample limit for legacy APE frames. Attackers can supply a crafted legacy Monkey's Audio file declaring an enormous nblocks value to force gigabyte-scale allocations and cause denial of service.

CVE-2026-125103 is an information disclosure vulnerability in FFmpeg versions up to 9.0.2. It occurs in the ff_mlz_decompression() function within libavcodec/mlz.c, where malformed MPEG-4 ALS files with out-of-range codes can cause uninitialized heap bytes to be copied into decoded audio output. This can lead to unintended disclosure of memory contents.

FFmpeg versions up to 9.0.2 have a vulnerability in the tak_decode_frame() function where uninitialized memory can be disclosed. This occurs because the function does not verify that multichannel decorrelation lists cover every audio channel, allowing crafted TAK files to cause heap memory leaks through undecoded audio samples.

CVE-2026-125101 is an information disclosure vulnerability in FFmpeg versions up to 9.0.2. It affects the VMnc decoder in libavcodec/vmnc.c, where an uninitialized cursor save area can be restored into later frames. This can cause uninitialized heap bytes to appear in decoded output when processing a crafted VMnc stream.

FFmpeg versions up to 9.0.2 contain an integer overflow vulnerability in the OpenEXR decoder's decode_frame() function. This flaw miscalculates the tiled block count when processing crafted OpenEXR images with large dimensions and small tiles. Exploitation can lead to skipping decoding steps and potentially disclosing uninitialized memory or stale frame data.

CVE-2026-125099 is a medium severity vulnerability in FFmpeg up to version 9.0.2. It involves an uninitialized memory disclosure in the GEM raster image decoder component, where crafted GEM .img images can cause uninitialized heap memory to be copied into decoded frames, potentially exposing sensitive data.

CVE-2026-125098 is an information disclosure vulnerability in FFmpeg versions up to 9.0.2. It occurs in the vp8_lossy_decode_alpha() function in libavcodec/webp.c, where the alpha plane memory is left uninitialized for short uncompressed ALPH chunks in WebP images. This can allow attackers to craft a WebP image with an ALPH chunk shorter than width * height, causing stale pixel data from previously decoded frames to be disclosed.

CVE-2026-125097 is a medium severity vulnerability in FFmpeg through version 9.0.2 involving uninitialized memory disclosure. The flaw exists in the raw_decode() function of libavcodec/rawdec.c, where the code fails to verify that the packet stride covers a full row for 1 to 8 bits per pixel video. This allows attackers to craft AVI, MOV, or NUT files with truncated low bit depth rawvideo packets that can leak uninitialized heap memory through the decoded frame output.

CVE-2026-125096 is a medium severity vulnerability in FFmpeg through version 9.0.2. It involves an uninitialized memory disclosure in the libavcodec/tiertexseqv.c component. An attacker can craft a malicious Tiertex SEQ file that triggers a failed run-length encoding (RLE) unpacking, causing the function seq_decode_op1() to copy uninitialized 64-byte stack memory into decoded frames. This leads to leakage of stack contents in the output video frames.

CVE-2026-125095 is a medium severity vulnerability in FFmpeg versions up to 9.0.2. It involves the C93 video decoder where uninitialized stack memory can be written into decoded frames due to improper handling of truncated Interplay C93 files. This can lead to disclosure of stack memory contents.

FFmpeg through 9.0.2 contains an infinite loop vulnerability in bit_allocation() in libavcodec/imc.c that allows attackers to hang decoding by supplying audio blocks with a negative bit budget. Attackers can craft IMC or IAC audio files that drive freebits negative, causing the reduction loop to never terminate and consuming 100% CPU.

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in mp_decode_frame() in libavcodec/mpegaudiodec_template.c because init_get_bits() failure is ignored after a signed integer overflow. Attackers can pass an oversized packet to the mp3adu decoder through the libavcodec API, causing reads through a NULL buffer that crash the process.

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in libavcodec/jvdec.c that allows attackers to crash applications by supplying oversized JV video packets. Attackers can pass a roughly 268435460-byte packet through the libavcodec API, overflowing the bit count so decode_frame() reads from a NULL buffer and causes denial of service.

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in tqi_decode_frame() in libavcodec/eatqi.c, which ignores init_get_bits() failure after an integer overflow. Attackers can supply a crafted EA file with a pIQT chunk carrying a 2^28-byte payload to crash the process, causing denial of service.

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in the Motion Pixels decoder because mp_decode_frame() ignores init_get_bits() failure. Attackers supplying a roughly 2^28-byte packet through the libavcodec API overflow the bit count, causing reads from a NULL buffer that crash the process.

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in the Bink video decoder because decode_frame() in libavcodec/bink.c ignores init_get_bits() failure. Attackers can supply a crafted Bink file with a frame of about 2^28 bytes, overflowing the bit count and crashing the process for denial of service.

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in vble_decode_frame() in libavcodec/vble.c because it ignores init_get_bits() failure on oversized packets. Attackers can supply a crafted AVI file with a 268435452-byte VBLE frame, causing reads from a NULL bit reader buffer that crash the process.

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in the Cirrus Logic AccuPak (CLJR) decoder in libavcodec/cljrdec.c because decode_frame() ignores init_get_bits() failure. Attackers can supply a crafted AVI file with a 2^28-byte CLJR frame that overflows the bit count, causing reads from a NULL buffer and crashing the process.

CVE-2026-125065 is a vulnerability in FFmpeg up to version 9.0.2 involving a NULL pointer dereference in the tgv_decode_inter() function. This occurs because the function does not properly handle failure from init_get_bits() when processing oversized packets. An attacker can exploit this by supplying a specially crafted EA file that triggers a denial of service by crashing the process.