CVE-2026-125099
LOW
NVD
CVSS Score
3.3
Severity
LOW
Published
Nov 09, 2026
Vendor
unknown
Description
FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in the GEM raster image decoder in libavcodec/gemdec.c that exposes uninitialized row-buffer bytes. Attackers can supply a crafted GEM .img image using SKIP or pattern opcodes to copy uninitialized heap memory into decoded frames, disclosing heap contents.
References
- https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25715
- https://github.com/FFmpeg/FFmpeg
- https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/gemdec.c#L258
- https://github.com/FFmpeg/FFmpeg/commit/e578999fa3c5f7efac1ea70bb7c2a7682013c7c9
- https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-uninitialized-memory-disclosure-via-gem-raster-decoder