{"id":"CVE-2026-125096","kind":"vulnerability","aliases":["CVE-2026-125096"],"related":[],"title":"FFmpeg: crafted Tiertex SEQ file leaks uninitialized stack memory into output","description":"FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in libavcodec/tiertexseqv.c that allows attackers to leak stack contents by triggering failed RLE unpacking. Attackers can supply a crafted Tiertex SEQ file so seq_decode_op1() copies an uninitialized 64-byte stack block into decoded frames, exposing stack memory in visible output.","summary":"FFmpeg's Tiertex SEQ decoder copies an uninitialized 64-byte stack block into decoded frames when RLE unpacking fails. An attacker who supplies a crafted SEQ file can read stack contents in the visible output.","severity":"medium","cvss":4.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ffmpeg","libavcodec","media-processing","package"],"not_affected_if":["no-untrusted-media","seq-decoder-unused"],"how_to_check":"- Check the installed FFmpeg version with `ffmpeg -version`; the sources say the flaw affects releases through `9.0.2`.\n- Look for applications that decode untrusted Tiertex SEQ files with libavcodec.","fix":"- The sources link a patch but do not state a fixed version. unknown","status":"open","published_at":"2026-11-09T19:16:50+00:00","first_seen_at":"2026-11-09T19:28:15+00:00","triaged_at":"2026-11-09T19:33:40+00:00","updated_at":"2026-11-09T19:33:40+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-09T19:33:40Z","model":"claude-haiku-5-5","output":{"fix":"- The sources link a patch but do not state a fixed version. unknown","reach":"unknown","title":"FFmpeg: crafted Tiertex SEQ file leaks uninitialized stack memory into output","impact":"low","summary":"FFmpeg's Tiertex SEQ decoder copies an uninitialized 64-byte stack block into decoded frames when RLE unpacking fails. An attacker who supplies a crafted SEQ file can read stack contents in the visible output.","audience":"developers","category":"package","nicknames":[],"who_cares":["ffmpeg","libavcodec","media-processing"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker reads stack memory contents from decoded output","analyst_note":"Confirm the fixed version and the patch commit from the NVD and linked patch pages, and whether the Tiertex decoder is in default builds.","how_to_check":"- Check the installed FFmpeg version with `ffmpeg -version`; the sources say the flaw affects releases through `9.0.2`.\n- Look for applications that decode untrusted Tiertex SEQ files with libavcodec.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-untrusted-media","seq-decoder-unused"],"who_is_affected":"Systems that decode Tiertex SEQ files with FFmpeg's libavcodec, especially when the files come from untrusted sources such as uploads or conversion services. Systems that never decode SEQ files are unlikely to be exposed. The sources do not say whether the default build enables this decoder.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000761,"input_tokens":4643,"output_tokens":593,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125096':14A,17A '-2026':13A,16A '64':32B,97C '9.0.2':61C 'allow':71C 'attack':44B,72C,82C 'block':35B,100C 'byte':33B,98C 'contain':62C 'content':54B,76C 'copi':29B,94C 'craft':2A,48B,86C 'cve':12A,15A 'decod':28B,37B,92C,102C 'disclosur':66C 'expos':104C 'fail':42B,79C 'ffmpeg':1A,18B,24B,59C 'file':5A,50B,89C 'frame':38B,103C 'leak':6A,74C 'libavcodec':19B 'libavcodec/tiertexseqv.c':69C 'media':21B 'media-process':20B 'memori':9A,65C,106C 'op1':93C 'output':11A,58B,109C 'packag':23B 'process':22B 'read':52B 'rle':40B,80C 'seq':4A,27B,49B,88C,91C 'stack':8A,34B,53B,75C,99C,105C 'suppli':46B,84C 'tiertex':3A,26B,87C 'trigger':78C 'uniniti':7A,31B,64C,96C 'unpack':41B,81C 'visibl':57B,108C 'vulner':67C","nicknames":[],"mitigations":[],"who_affected":"Systems that decode Tiertex SEQ files with FFmpeg's libavcodec, especially when the files come from untrusted sources such as uploads or conversion services. Systems that never decode SEQ files are unlikely to be exposed. The sources do not say whether the default build enables this decoder.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ffmpeg","libavcodec","mediaprocessing","medium","package"],"campaign_type":null,"search_a":"'-125096':14A,17A '-2026':13A,16A 'craft':2A 'cve':12A,15A 'ffmpeg':1A 'file':5A 'leak':6A 'memori':9A 'output':11A 'seq':4A 'stack':8A 'tiertex':3A 'uniniti':7A","search_b":"'64':32B 'attack':44B 'block':35B 'byte':33B 'content':54B 'copi':29B 'craft':48B 'decod':28B,37B 'fail':42B 'ffmpeg':18B,24B 'file':50B 'frame':38B 'libavcodec':19B 'media':21B 'media-process':20B 'output':58B 'packag':23B 'process':22B 'read':52B 'rle':40B 'seq':27B,49B 'stack':34B,53B 'suppli':46B 'tiertex':26B 'uniniti':31B 'unpack':41B 'visibl':57B","search_c":"'64':97C '9.0.2':61C 'allow':71C 'attack':72C,82C 'block':100C 'byte':98C 'contain':62C 'content':76C 'copi':94C 'craft':86C 'decod':92C,102C 'disclosur':66C 'expos':104C 'fail':79C 'ffmpeg':59C 'file':89C 'frame':103C 'leak':74C 'libavcodec/tiertexseqv.c':69C 'memori':65C,106C 'op1':93C 'output':109C 'rle':80C 'seq':88C,91C 'stack':75C,99C,105C 'suppli':84C 'tiertex':87C 'trigger':78C 'uniniti':64C,96C 'unpack':81C 'visibl':108C 'vulner':67C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T19:16:50+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125096","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125096","severity":null,"published_at":"2026-11-09T19:16:50+00:00","modified_at":"2026-11-09T19:16:50+00:00","first_seen_at":"2026-11-09T19:28:15+00:00","fetched_at":"2026-11-09T19:28:15+00:00","note":null}],"documents":[{"id":109209,"url":"https://github.com/FFmpeg/FFmpeg/commit/c896bbb24535685509a816af09665cb73bf2d0c7","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109210,"url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-uninitialized-memory-disclosure-via-tiertex-seq-decoder","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}