{"id":"CVE-2026-125098","kind":"vulnerability","aliases":["CVE-2026-125098"],"related":[],"title":"FFmpeg: crafted WebP image leaks stale pixel memory from earlier frames","description":"FFmpeg through 9.0.2 contains an information disclosure vulnerability in vp8_lossy_decode_alpha() in libavcodec/webp.c that leaves alpha plane memory uninitialized for short uncompressed ALPH chunks. Attackers can supply a crafted WebP image whose ALPH chunk is shorter than width * height to disclose stale pixel data from previously decoded frames.","summary":"FFmpeg's WebP decoder in libavcodec leaves the alpha plane uninitialized when a WebP image has a short uncompressed ALPH chunk. An attacker who supplies such an image can read stale pixel data left over from previously decoded frames.","severity":"medium","cvss":4.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ffmpeg","libavcodec","media-processing","runtime","webp"],"not_affected_if":["no-webp-decoding","trusted-input-only"],"how_to_check":"- Run `ffmpeg -version` and compare against the fixed release named in the linked patch.\n- Check whether the WebP decoder is used on untrusted images in your pipeline.","fix":null,"status":"open","published_at":"2026-11-09T19:16:50+00:00","first_seen_at":"2026-11-09T19:28:15+00:00","triaged_at":"2026-11-09T19:33:35+00:00","updated_at":"2026-11-09T19:33:35+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-09T19:33:35Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"FFmpeg: crafted WebP image leaks stale pixel memory from earlier frames","impact":"low","summary":"FFmpeg's WebP decoder in libavcodec leaves the alpha plane uninitialized when a WebP image has a short uncompressed ALPH chunk. An attacker who supplies such an image can read stale pixel data left over from previously decoded frames.","audience":"developers","category":"runtime","nicknames":[],"who_cares":["ffmpeg","libavcodec","webp","media-processing"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Stale pixel data from other decoded images is disclosed to the attacker","analyst_note":"Confirm the fixed FFmpeg version from the linked patch on github.com and the vulncheck advisory; the fix version is not stated in the given sources.","how_to_check":"- Run `ffmpeg -version` and compare against the fixed release named in the linked patch.\n- Check whether the WebP decoder is used on untrusted images in your pipeline.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["trusted-input-only","no-webp-decoding"],"who_is_affected":"Systems that run FFmpeg to decode WebP images from untrusted sources, such as upload or thumbnail services, are the ones exposed. Pipelines that only process trusted local media can skip it. The sources do not state the exact affected build beyond 'through 9.0.2'.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000745,"input_tokens":4631,"output_tokens":563,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125098':14A,17A '-2026':13A,16A '9.0.2':66C 'alph':44B,88C,98C 'alpha':33B,76C,81C 'attack':47B,90C 'chunk':45B,89C,99C 'contain':67C 'craft':2A,94C 'cve':12A,15A 'data':57B,109C 'decod':28B,62B,75C,112C 'disclos':106C 'disclosur':70C 'earlier':10A 'ffmpeg':1A,18B,25B,64C 'frame':11A,63B,113C 'height':104C 'imag':4A,39B,52B,96C 'inform':69C 'leak':5A 'leav':31B,80C 'left':58B 'libavcodec':19B,30B 'libavcodec/webp.c':78C 'lossi':74C 'media':21B 'media-process':20B 'memori':8A,83C 'pixel':7A,56B,108C 'plane':34B,82C 'previous':61B,111C 'process':22B 'read':54B 'runtim':23B 'short':42B,86C 'shorter':101C 'stale':6A,55B,107C 'suppli':49B,92C 'uncompress':43B,87C 'uniniti':35B,84C 'vp8':73C 'vulner':71C 'webp':3A,24B,27B,38B,95C 'whose':97C 'width':103C","nicknames":[],"mitigations":[],"who_affected":"Systems that run FFmpeg to decode WebP images from untrusted sources, such as upload or thumbnail services, are the ones exposed. Pipelines that only process trusted local media can skip it. The sources do not state the exact affected build beyond 'through 9.0.2'.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ffmpeg","libavcodec","mediaprocessing","medium","runtime","webp"],"campaign_type":null,"search_a":"'-125098':14A,17A '-2026':13A,16A 'craft':2A 'cve':12A,15A 'earlier':10A 'ffmpeg':1A 'frame':11A 'imag':4A 'leak':5A 'memori':8A 'pixel':7A 'stale':6A 'webp':3A","search_b":"'alph':44B 'alpha':33B 'attack':47B 'chunk':45B 'data':57B 'decod':28B,62B 'ffmpeg':18B,25B 'frame':63B 'imag':39B,52B 'leav':31B 'left':58B 'libavcodec':19B,30B 'media':21B 'media-process':20B 'pixel':56B 'plane':34B 'previous':61B 'process':22B 'read':54B 'runtim':23B 'short':42B 'stale':55B 'suppli':49B 'uncompress':43B 'uniniti':35B 'webp':24B,27B,38B","search_c":"'9.0.2':66C 'alph':88C,98C 'alpha':76C,81C 'attack':90C 'chunk':89C,99C 'contain':67C 'craft':94C 'data':109C 'decod':75C,112C 'disclos':106C 'disclosur':70C 'ffmpeg':64C 'frame':113C 'height':104C 'imag':96C 'inform':69C 'leav':80C 'libavcodec/webp.c':78C 'lossi':74C 'memori':83C 'pixel':108C 'plane':82C 'previous':111C 'short':86C 'shorter':101C 'stale':107C 'suppli':92C 'uncompress':87C 'uniniti':84C 'vp8':73C 'vulner':71C 'webp':95C 'whose':97C 'width':103C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T19:16:50+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125098","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125098","severity":null,"published_at":"2026-11-09T19:16:50+00:00","modified_at":"2026-11-09T19:16:50+00:00","first_seen_at":"2026-11-09T19:28:15+00:00","fetched_at":"2026-11-09T19:28:15+00:00","note":null}],"documents":[{"id":109213,"url":"https://github.com/FFmpeg/FFmpeg/commit/92b318e0b33623720d9f128ad7bc5fa8277c34f7","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109214,"url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-webp-decoder-information-disclosure-via-short-alph-chunk","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}