CVE-2026-125195Low· 2.5▾ SunlitFFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in adpcm_encode_frame() in libavcodec/adpcmenc.c that leaks heap bytes when encoding mono ADPCM_MS audio with trellis enabled. Attackers submitting audio to a…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 13.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in adpcm_encode_frame() in libavcodec/adpcmenc.c that leaks heap bytes when encoding mono ADPCM_MS audio with trellis enabled. Attackers submitting audio to a service using this encoding receive output packets where about half of each block contains stale heap memory from the encoding process.
FFmpeg <= 9.0.2Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-125217Low· 3.3FFmpeg through 9.0.2 RoQ DPCM Encoder Uninitialized Heap Memory Disclosure
CVE-2026-125268Low· 3.3FFmpeg through 9.0.2 Uninitialized Heap Memory Disclosure in CFHD Decoder
CVE-2026-125266Low· 3.3FFmpeg through 9.0.2 Uninitialized Stack Memory Disclosure via SANM Codec 23
CVE-2026-125102Low· 3.3FFmpeg through 9.0.2 TAK Decoder Uninitialized Memory Disclosure via takdec.c
CVE-2026-125097Low· 3.3FFmpeg through 9.0.2 Uninitialized Heap Memory Disclosure via rawdec.c Raw Video Decoder
CVE-2026-125103Low· 3.3FFmpeg through 9.0.2 Uninitialized Heap Disclosure via MLZ Decompressor in ALS Decoder