CVE-2026-125095 · Package
NO FIX YET
FFmpeg's C93 video decoder in libavcodec never checks how many color table bytes were copied, so a crafted truncated Interplay C93 file makes it write uninitialized stack bytes into decoded frames. An attacker can read stack memory contents through the decoded output.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Systems that decode untrusted or user-supplied video files with FFmpeg's libavcodec are exposed, since the flaw triggers on a crafted Interplay C93 file. Services that only process trusted media or do not run FFmpeg on uploaded content can skip it. The sources do not state a fixed version, though a patch is linked.
Not affected if c93-decoder-unused, no-untrusted-media
Who cares ffmpeg, libavcodec, media-processing
ffmpeg -version; the sources cover releases through 9.0.2.No fix yet, per the sources.
FFmpeg through 9.0.2 contains an uninitialized memory use vulnerability in the C93 video decoder in libavcodec/c93.c, where decode_frame() never checks how many color table bytes were copied. Attackers can supply a crafted truncated Interplay C93 file so draw_n_color() writes uninitialized stack bytes into decoded frames, disclosing stack memory contents.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.