{"id":"CVE-2026-125099","kind":"vulnerability","aliases":["CVE-2026-125099"],"related":[],"title":"FFmpeg: crafted GEM image leaks uninitialized heap memory into decoded frames","description":"FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in the GEM raster image decoder in libavcodec/gemdec.c that exposes uninitialized row-buffer bytes. Attackers can supply a crafted GEM .img image using SKIP or pattern opcodes to copy uninitialized heap memory into decoded frames, disclosing heap contents.","summary":"FFmpeg's GEM raster image decoder in libavcodec/gemdec.c leaves row-buffer bytes uninitialized when handling SKIP or pattern opcodes. A crafted GEM .img file can copy uninitialized heap memory into decoded frames, disclosing heap contents.","severity":"medium","cvss":4.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ffmpeg","image-processing","libavcodec","package"],"not_affected_if":["trusted-input-only"],"how_to_check":"- Check the installed FFmpeg version with `ffmpeg -version`; the sources say versions through `9.0.2` are affected\n- Look for applications that decode untrusted GEM `.img` files through FFmpeg or libavcodec\n- Fixed version: unknown","fix":"- Patch available on the upstream FFmpeg project; the sources do not name a fixed version number","status":"open","published_at":"2026-11-09T19:16:50+00:00","first_seen_at":"2026-11-09T19:28:15+00:00","triaged_at":"2026-11-09T19:33:36+00:00","updated_at":"2026-11-09T19:33:36+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-09T19:33:36Z","model":"claude-haiku-5-5","output":{"fix":"- Patch available on the upstream FFmpeg project; the sources do not name a fixed version number","reach":"unknown","title":"FFmpeg: crafted GEM image leaks uninitialized heap memory into decoded frames","impact":"low","summary":"FFmpeg's GEM raster image decoder in libavcodec/gemdec.c leaves row-buffer bytes uninitialized when handling SKIP or pattern opcodes. A crafted GEM .img file can copy uninitialized heap memory into decoded frames, disclosing heap contents.","audience":"developers","category":"package","nicknames":[],"who_cares":["ffmpeg","libavcodec","image-processing"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Heap memory contents are disclosed in decoded output frames.","analyst_note":"Confirm the fixed FFmpeg version and exact patch from the github.com fix link and the NVD entry; the product ranges were not supplied.","how_to_check":"- Check the installed FFmpeg version with `ffmpeg -version`; the sources say versions through `9.0.2` are affected\n- Look for applications that decode untrusted GEM `.img` files through FFmpeg or libavcodec\n- Fixed version: unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["trusted-input-only"],"who_is_affected":"Systems that run FFmpeg or libavcodec and decode image files from untrusted sources can expose heap contents in decoded output. Services that only process trusted local media are lower risk. unknown whether a specific fixed version is stated by the sources.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000773,"input_tokens":4629,"output_tokens":621,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125099':14A,17A '-2026':13A,16A '9.0.2':62C 'attack':84C 'buffer':35B,82C 'byte':36B,83C 'contain':63C 'content':59B,107C 'copi':50B,98C 'craft':2A,45B,88C 'cve':12A,15A 'decod':10A,29B,55B,74C,103C 'disclos':57B,105C 'disclosur':67C 'expos':78C 'ffmpeg':1A,18B,24B,60C 'file':48B 'frame':11A,56B,104C 'gem':3A,26B,46B,71C,89C 'handl':39B 'heap':7A,52B,58B,100C,106C 'imag':4A,20B,28B,73C,91C 'image-process':19B 'img':47B,90C 'leak':5A 'leav':32B 'libavcodec':22B 'libavcodec/gemdec.c':31B,76C 'memori':8A,53B,66C,101C 'opcod':43B,96C 'packag':23B 'pattern':42B,95C 'process':21B 'raster':27B,72C 'row':34B,81C 'row-buff':33B,80C 'skip':40B,93C 'suppli':86C 'uniniti':6A,37B,51B,65C,79C,99C 'use':92C 'vulner':68C","nicknames":[],"mitigations":[],"who_affected":"Systems that run FFmpeg or libavcodec and decode image files from untrusted sources can expose heap contents in decoded output. Services that only process trusted local media are lower risk. unknown whether a specific fixed version is stated by the sources.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ffmpeg","imageprocessing","libavcodec","medium","package"],"campaign_type":null,"search_a":"'-125099':14A,17A '-2026':13A,16A 'craft':2A 'cve':12A,15A 'decod':10A 'ffmpeg':1A 'frame':11A 'gem':3A 'heap':7A 'imag':4A 'leak':5A 'memori':8A 'uniniti':6A","search_b":"'buffer':35B 'byte':36B 'content':59B 'copi':50B 'craft':45B 'decod':29B,55B 'disclos':57B 'ffmpeg':18B,24B 'file':48B 'frame':56B 'gem':26B,46B 'handl':39B 'heap':52B,58B 'imag':20B,28B 'image-process':19B 'img':47B 'leav':32B 'libavcodec':22B 'libavcodec/gemdec.c':31B 'memori':53B 'opcod':43B 'packag':23B 'pattern':42B 'process':21B 'raster':27B 'row':34B 'row-buff':33B 'skip':40B 'uniniti':37B,51B","search_c":"'9.0.2':62C 'attack':84C 'buffer':82C 'byte':83C 'contain':63C 'content':107C 'copi':98C 'craft':88C 'decod':74C,103C 'disclos':105C 'disclosur':67C 'expos':78C 'ffmpeg':60C 'frame':104C 'gem':71C,89C 'heap':100C,106C 'imag':73C,91C 'img':90C 'libavcodec/gemdec.c':76C 'memori':66C,101C 'opcod':96C 'pattern':95C 'raster':72C 'row':81C 'row-buff':80C 'skip':93C 'suppli':86C 'uniniti':65C,79C,99C 'use':92C 'vulner':68C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T19:16:50+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125099","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125099","severity":null,"published_at":"2026-11-09T19:16:50+00:00","modified_at":"2026-11-09T19:16:50+00:00","first_seen_at":"2026-11-09T19:28:15+00:00","fetched_at":"2026-11-09T19:28:15+00:00","note":null}],"documents":[{"id":109215,"url":"https://github.com/FFmpeg/FFmpeg/commit/e578999fa3c5f7efac1ea70bb7c2a7682013c7c9","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109216,"url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-uninitialized-memory-disclosure-via-gem-raster-decoder","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}