CVE-2026-125099 · Package
NO FIX YET · SEE WHAT TO DO
FFmpeg's GEM raster image decoder in libavcodec/gemdec.c leaves row-buffer bytes uninitialized when handling SKIP or pattern opcodes. A crafted GEM .img file can copy uninitialized heap memory into decoded frames, disclosing heap contents.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Systems that run FFmpeg or libavcodec and decode image files from untrusted sources can expose heap contents in decoded output. Services that only process trusted local media are lower risk. unknown whether a specific fixed version is stated by the sources.
Not affected if trusted-input-only
Who cares ffmpeg, image-processing, libavcodec
ffmpeg -version; the sources say versions through 9.0.2 are affected.img files through FFmpeg or libavcodecFFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in the GEM raster image decoder in libavcodec/gemdec.c that exposes uninitialized row-buffer bytes. Attackers can supply a crafted GEM .img image using SKIP or pattern opcodes to copy uninitialized heap memory into decoded frames, disclosing heap contents.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.