CVE-2026-125098 · Runtime
NO FIX YET
FFmpeg's WebP decoder in libavcodec leaves the alpha plane uninitialized when a WebP image has a short uncompressed ALPH chunk. An attacker who supplies such an image can read stale pixel data left over from previously decoded frames.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Systems that run FFmpeg to decode WebP images from untrusted sources, such as upload or thumbnail services, are the ones exposed. Pipelines that only process trusted local media can skip it. The sources do not state the exact affected build beyond 'through 9.0.2'.
Not affected if no-webp-decoding, trusted-input-only
Who cares ffmpeg, libavcodec, media-processing, webp
ffmpeg -version and compare against the fixed release named in the linked patch.No fix yet, per the sources.
FFmpeg through 9.0.2 contains an information disclosure vulnerability in vp8_lossy_decode_alpha() in libavcodec/webp.c that leaves alpha plane memory uninitialized for short uncompressed ALPH chunks. Attackers can supply a crafted WebP image whose ALPH chunk is shorter than width * height to disclose stale pixel data from previously decoded frames.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.