CVE-2026-125101 · Package
NO FIX YET
FFmpeg's VMnc video decoder in libavcodec can restore an unwritten cursor save area into later frames when a frame fails after loading a cursor shape. An attacker who supplies a crafted VMnc stream can make uninitialized heap memory appear in the decoded output.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Systems that decode untrusted VMnc video streams with FFmpeg, such as media processing services that accept user uploads. Installations that never decode VMnc content are unlikely to be exposed. The sources do not name a fixed version.
Not affected if no-vmnc-decoding
Who cares ffmpeg, libavcodec, media-processing
Unknown from the sources.
No fix yet, per the sources.
FFmpeg through 9.0.2 contains an information disclosure vulnerability in the VMnc decoder in libavcodec/vmnc.c that restores an unwritten cursor save area into later frames. Attackers can supply a crafted VMnc stream where a frame fails after loading a cursor shape, causing uninitialized heap bytes from screendta to appear in decoded output.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.