{"id":"CVE-2026-125184","title":"FFmpeg 6.1 through 9.0.2 Information Disclosure via CamStudio Decoder cscd.c","summary":"FFmpeg 6.1 through 9.0.2 contains an information disclosure vulnerability in the CamStudio decoder (libavcodec/cscd.c) that copies uninitialized heap memory into decoded frames when decompressed payloads are short. Attackers can supply a…","severity":"low","cvss":3.3,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","cvssSource":"cna","cwe":["CWE-908"],"vendor":"FFmpeg","product":"FFmpeg","affected":["FFmpeg >= 6.1 <= 9.0.2"],"published":"2026-11-09","updated":"2026-11-09","sourceUpdated":"2026-11-09T19:11:08.881Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-125184","references":[{"url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25716"},{"url":"https://github.com/FFmpeg/FFmpeg/commit/e58c4eb98f0f3c0523089fb9d037eedfcbd204d9","label":"Patch Commit"},{"url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/cscd.c#L152"},{"url":"https://github.com/FFmpeg/FFmpeg"},{"url":"https://www.vulncheck.com/advisories/ffmpeg-6.1-through-9.0.2-information-disclosure-via-camstudio-decoder-cscd-c","label":"VulnCheck Advisory: FFmpeg 6.1 through 9.0.2 Information Disclosure via CamStudio Decoder cscd.c"}],"tags":["cve.org"],"ingestedAt":"2026-11-09T19:18:02.611Z","slug":"CVE-2026-125184","body":"## Overview\n\nFFmpeg 6.1 through 9.0.2 contains an information disclosure vulnerability in the CamStudio decoder (libavcodec/cscd.c) that copies uninitialized heap memory into decoded frames when decompressed payloads are short. Attackers can supply a crafted AVI with a CSCD stream whose LZO or zlib frames decompress to fewer bytes than the frame size, recovering heap contents from the decoded or re-encoded output.\n\n## Affected\n\n- `FFmpeg >= 6.1 <= 9.0.2`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":18,"depthScoreParts":{"impact":18.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}