CVE-2026-125096Low· 3.3▾ SunlitFFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in libavcodec/tiertexseqv.c that allows attackers to leak stack contents by triggering failed RLE unpacking. Attackers can supply a crafted Tiertex SEQ file s…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 18.2 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in libavcodec/tiertexseqv.c that allows attackers to leak stack contents by triggering failed RLE unpacking. Attackers can supply a crafted Tiertex SEQ file so seq_decode_op1() copies an uninitialized 64-byte stack block into decoded frames, exposing stack memory in visible output.
FFmpeg <= 9.0.2Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-125097Low· 3.3FFmpeg through 9.0.2 Uninitialized Heap Memory Disclosure via rawdec.c Raw Video Decoder
CVE-2026-125098Low· 3.3FFmpeg through 9.0.2 WebP Decoder Information Disclosure via Short ALPH Chunk
CVE-2026-125268Low· 3.3FFmpeg through 9.0.2 Uninitialized Heap Memory Disclosure in CFHD Decoder
CVE-2026-125266Low· 3.3FFmpeg through 9.0.2 Uninitialized Stack Memory Disclosure via SANM Codec 23
CVE-2026-125102Low· 3.3FFmpeg through 9.0.2 TAK Decoder Uninitialized Memory Disclosure via takdec.c
CVE-2026-125103Low· 3.3FFmpeg through 9.0.2 Uninitialized Heap Disclosure via MLZ Decompressor in ALS Decoder