CVE-2026-125097Low· 3.3▾ SunlitFFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in raw_decode() in libavcodec/rawdec.c that fails to verify packet stride covers a full row for 1 to 8 bits per pixel video. Attackers can supply crafted AVI,…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 18.2 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in raw_decode() in libavcodec/rawdec.c that fails to verify packet stride covers a full row for 1 to 8 bits per pixel video. Attackers can supply crafted AVI, MOV or NUT files with truncated low bit depth rawvideo packets to leak uninitialized heap memory through decoded frame output.
FFmpeg <= 9.0.2Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-125096Low· 3.3FFmpeg through 9.0.2 Uninitialized Memory Disclosure via Tiertex SEQ Decoder
CVE-2026-125098Low· 3.3FFmpeg through 9.0.2 WebP Decoder Information Disclosure via Short ALPH Chunk
CVE-2026-125268Low· 3.3FFmpeg through 9.0.2 Uninitialized Heap Memory Disclosure in CFHD Decoder
CVE-2026-125266Low· 3.3FFmpeg through 9.0.2 Uninitialized Stack Memory Disclosure via SANM Codec 23
CVE-2026-125102Low· 3.3FFmpeg through 9.0.2 TAK Decoder Uninitialized Memory Disclosure via takdec.c
CVE-2026-125103Low· 3.3FFmpeg through 9.0.2 Uninitialized Heap Disclosure via MLZ Decompressor in ALS Decoder