CVE-2026-125192mediumCWE-908

CVE-2026-125192: falha de média gravidade em FFmpeg

FFmpeg through 9.0.2 Heap Memory Disclosure via DXA Decoder Uninitialized Buffer

Publicada em

Seguir esta CVE+ Monitorar FFmpeg

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

10Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 4.8
FFmpeg through 9.0.2 contains an uninitialized memory vulnerability in the DXA decoder in libavcodec/dxa.c that allows attackers to disclose heap memory via crafted DXA files. Attackers can supply a DXA video with a type 4 frame that copies the uninitialized decomp_buf buffer into output pictures, exposing leftover heap contents in decoded frames.
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
FFmpeg · FFmpeg
CVEs relacionadas — FFmpeg

No mesmo produto, das mais perigosas para as menos.

CVE-2026-8461HIGHHeap out-of-bounds write via odd slice_height in FFmpeg MagicYUV decoderEPSS 1.6%CVE-2026-64831HIGHFFmpeg 8.0 - 8.1.2 Stack Buffer Overflow in Vulkan HEVC DecoderEPSS 0.9%CVE-2026-66040HIGHFFmpeg Heap Out-of-Bounds Write via PNG/APNG eXIf EncoderEPSS 0.8%CVE-2026-64834HIGHFFmpeg 0.6.3 - 8.1.2 Infinite Loop DoS via RTP/ASF DemuxerEPSS 0.7%CVE-2026-75143CRITICALFFmpeg Heap Buffer Overflow via RIST Protocol ReaderEPSS 0.7%CVE-2026-64830HIGHFFmpeg 2.1 - 8.1.2 Heap Buffer Overflow via VobSub Subtitle DemuxerEPSS 0.6%