CVE-2026-125268Low· 3.3▾ SunlitFFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in the CineForm HD decoder that allows attackers to leak heap memory via unzeroed idwt_tmp buffers in libavcodec/cfhd.c. Attackers can supply a crafted CFHD f…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 18.2 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in the CineForm HD decoder that allows attackers to leak heap memory via unzeroed idwt_tmp buffers in libavcodec/cfhd.c. Attackers can supply a crafted CFHD file with an ImageHeight tag exceeding coded band heights, causing uninitialized heap bytes to be filtered into decoded video output.
FFmpeg <= 9.0.2Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-125266Low· 3.3FFmpeg through 9.0.2 Uninitialized Stack Memory Disclosure via SANM Codec 23
CVE-2026-125102Low· 3.3FFmpeg through 9.0.2 TAK Decoder Uninitialized Memory Disclosure via takdec.c
CVE-2026-125097Low· 3.3FFmpeg through 9.0.2 Uninitialized Heap Memory Disclosure via rawdec.c Raw Video Decoder
CVE-2026-125103Low· 3.3FFmpeg through 9.0.2 Uninitialized Heap Disclosure via MLZ Decompressor in ALS Decoder
CVE-2026-125096Low· 3.3FFmpeg through 9.0.2 Uninitialized Memory Disclosure via Tiertex SEQ Decoder
CVE-2026-125101Low· 3.3FFmpeg through 9.0.2 VMnc Decoder Uninitialized Heap Memory Disclosure