CVE-2026-125175mediumCWE-908

CVE-2026-125175: falha de média gravidade em FFmpeg

FFmpeg through 9.0.2 Information Disclosure via Flash Screen Video Decoder

Publicada em

Seguir esta CVE+ Monitorar FFmpeg

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

10Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 4.8
FFmpeg through 9.0.2 contains an information disclosure vulnerability in flashsv_decode_block() in libavcodec/flashsv.c that copies uninitialized heap memory into decoded frames when inflate output is short. Attackers can supply a crafted FLV with an FSV1 stream whose zlib block data decompresses short, then recover heap contents from the decoded or re-encoded output.
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
FFmpeg · FFmpeg
CVEs relacionadas — FFmpeg

No mesmo produto, das mais perigosas para as menos.

CVE-2026-8461HIGHHeap out-of-bounds write via odd slice_height in FFmpeg MagicYUV decoderEPSS 1.6%CVE-2026-64831HIGHFFmpeg 8.0 - 8.1.2 Stack Buffer Overflow in Vulkan HEVC DecoderEPSS 0.9%CVE-2026-66040HIGHFFmpeg Heap Out-of-Bounds Write via PNG/APNG eXIf EncoderEPSS 0.8%CVE-2026-64834HIGHFFmpeg 0.6.3 - 8.1.2 Infinite Loop DoS via RTP/ASF DemuxerEPSS 0.7%CVE-2026-75143CRITICALFFmpeg Heap Buffer Overflow via RIST Protocol ReaderEPSS 0.7%CVE-2026-64830HIGHFFmpeg 2.1 - 8.1.2 Heap Buffer Overflow via VobSub Subtitle DemuxerEPSS 0.6%