CVE-2026-125095
LOW
NVD
CVSS Score
3.3
Severity
LOW
Published
Nov 09, 2026
Vendor
unknown
Description
FFmpeg through 9.0.2 contains an uninitialized memory use vulnerability in the C93 video decoder in libavcodec/c93.c, where decode_frame() never checks how many color table bytes were copied. Attackers can supply a crafted truncated Interplay C93 file so draw_n_color() writes uninitialized stack bytes into decoded frames, disclosing stack memory contents.
References
- https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25715
- https://github.com/FFmpeg/FFmpeg
- https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/c93.c#L198
- https://github.com/FFmpeg/FFmpeg/commit/ac0106851a4dac555c967421dfc96c0135183133
- https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-c93-decoder-uninitialized-stack-memory-disclosure