CVE-2026-125101: medium-severity vulnerability in FFmpeg
FFmpeg through 9.0.2 VMnc Decoder Uninitialized Heap Memory Disclosure
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
10Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 4.8
FFmpeg through 9.0.2 contains an information disclosure vulnerability in the VMnc decoder in libavcodec/vmnc.c that restores an unwritten cursor save area into later frames. Attackers can supply a crafted VMnc stream where a frame fails after loading a cursor shape, causing uninitialized heap bytes from screendta to appear in decoded output.
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
FFmpeg · FFmpegRelated CVEs — FFmpeg
In the same product, most dangerous first.
CVE-2026-8461HIGHHeap out-of-bounds write via odd slice_height in FFmpeg MagicYUV decoderEPSS 1.6%CVE-2026-64831HIGHFFmpeg 8.0 - 8.1.2 Stack Buffer Overflow in Vulkan HEVC DecoderEPSS 0.9%CVE-2026-66040HIGHFFmpeg Heap Out-of-Bounds Write via PNG/APNG eXIf EncoderEPSS 0.8%CVE-2026-64834HIGHFFmpeg 0.6.3 - 8.1.2 Infinite Loop DoS via RTP/ASF DemuxerEPSS 0.7%CVE-2026-75143CRITICALFFmpeg Heap Buffer Overflow via RIST Protocol ReaderEPSS 0.7%CVE-2026-64830HIGHFFmpeg 2.1 - 8.1.2 Heap Buffer Overflow via VobSub Subtitle DemuxerEPSS 0.6%
References
https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25716https://github.com/FFmpeg/FFmpeghttps://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/vmnc.c#L348https://github.com/FFmpeg/FFmpeg/commit/50865f20b1f474e6b11735c88f668751bc9aa528https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-vmnc-decoder-uninitialized-heap-memory-disclosure