CVE-2026-125097

medium

Description

FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in raw_decode() in libavcodec/rawdec.c that fails to verify packet stride covers a full row for 1 to 8 bits per pixel video. Attackers can supply crafted AVI, MOV or NUT files with truncated low bit depth rawvideo packets to leak uninitialized heap memory through decoded frame output.

References

https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-uninitialized-heap-memory-disclosure-via-rawdec-c-raw-video-decoder

https://github.com/FFmpeg/FFmpeg/commit/01a395b935b9da12dbeca588a7130c4db6a14689

https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/rawdec.c#L208

https://github.com/FFmpeg/FFmpeg

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-120251

https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25715

Details

Source: Mitre, NVD

Published: 2026-11-09

Updated: 2026-11-10

Risk Information

CVSS v2

Base Score: 2.1

Vector: CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N

Severity: Low

CVSS v3

Base Score: 3.3

Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Severity: Low

CVSS v4

Base Score: 4.8

Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Severity: Medium

EPSS

EPSS: 0.00128