{"id":"CVE-2026-125101","kind":"vulnerability","aliases":["CVE-2026-125101"],"related":[],"title":"FFmpeg: VMnc decoder leaks uninitialized heap bytes into decoded video output","description":"FFmpeg through 9.0.2 contains an information disclosure vulnerability in the VMnc decoder in libavcodec/vmnc.c that restores an unwritten cursor save area into later frames. Attackers can supply a crafted VMnc stream where a frame fails after loading a cursor shape, causing uninitialized heap bytes from screendta to appear in decoded output.","summary":"FFmpeg's VMnc video decoder in libavcodec can restore an unwritten cursor save area into later frames when a frame fails after loading a cursor shape. An attacker who supplies a crafted VMnc stream can make uninitialized heap memory appear in the decoded output.","severity":"medium","cvss":4.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ffmpeg","libavcodec","media-processing","package"],"not_affected_if":["no-vmnc-decoding"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-09T19:16:51+00:00","first_seen_at":"2026-11-09T19:28:16+00:00","triaged_at":"2026-11-09T19:32:28+00:00","updated_at":"2026-11-09T19:32:28+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-09T19:32:28Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"unknown","title":"FFmpeg: VMnc decoder leaks uninitialized heap bytes into decoded video output","impact":"low","summary":"FFmpeg's VMnc video decoder in libavcodec can restore an unwritten cursor save area into later frames when a frame fails after loading a cursor shape. An attacker who supplies a crafted VMnc stream can make uninitialized heap memory appear in the decoded output.","audience":"businesses","category":"package","nicknames":[],"who_cares":["ffmpeg","libavcodec","media-processing"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"uninitialized heap bytes disclosed in decoded output","analyst_note":"Find the fixed FFmpeg version and the upstream patch at github.com linked in the sources, then confirm which FFmpeg releases are affected.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-vmnc-decoding"],"who_is_affected":"Systems that decode untrusted VMnc video streams with FFmpeg, such as media processing services that accept user uploads. Installations that never decode VMnc content are unlikely to be exposed. The sources do not name a fixed version.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000716,"input_tokens":4626,"output_tokens":506,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125101':14A,17A '-2026':13A,16A '9.0.2':70C 'appear':63B,115C 'area':37B,88C 'attack':51B,92C 'byte':7A,111C 'caus':108C 'contain':71C 'craft':55B,96C 'cursor':35B,48B,86C,106C 'cve':12A,15A 'decod':3A,9A,28B,66B,79C,117C 'disclosur':74C 'fail':44B,102C 'ffmpeg':1A,18B,24B,68C 'frame':40B,43B,91C,101C 'heap':6A,61B,110C 'inform':73C 'later':39B,90C 'leak':4A 'libavcodec':19B,30B 'libavcodec/vmnc.c':81C 'load':46B,104C 'make':59B 'media':21B 'media-process':20B 'memori':62B 'output':11A,67B,118C 'packag':23B 'process':22B 'restor':32B,83C 'save':36B,87C 'screendta':113C 'shape':49B,107C 'stream':57B,98C 'suppli':53B,94C 'uniniti':5A,60B,109C 'unwritten':34B,85C 'video':10A,27B 'vmnc':2A,26B,56B,78C,97C 'vulner':75C","nicknames":[],"mitigations":[],"who_affected":"Systems that decode untrusted VMnc video streams with FFmpeg, such as media processing services that accept user uploads. Installations that never decode VMnc content are unlikely to be exposed. The sources do not name a fixed version.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ffmpeg","libavcodec","mediaprocessing","medium","package"],"campaign_type":null,"search_a":"'-125101':14A,17A '-2026':13A,16A 'byte':7A 'cve':12A,15A 'decod':3A,9A 'ffmpeg':1A 'heap':6A 'leak':4A 'output':11A 'uniniti':5A 'video':10A 'vmnc':2A","search_b":"'appear':63B 'area':37B 'attack':51B 'craft':55B 'cursor':35B,48B 'decod':28B,66B 'fail':44B 'ffmpeg':18B,24B 'frame':40B,43B 'heap':61B 'later':39B 'libavcodec':19B,30B 'load':46B 'make':59B 'media':21B 'media-process':20B 'memori':62B 'output':67B 'packag':23B 'process':22B 'restor':32B 'save':36B 'shape':49B 'stream':57B 'suppli':53B 'uniniti':60B 'unwritten':34B 'video':27B 'vmnc':26B,56B","search_c":"'9.0.2':70C 'appear':115C 'area':88C 'attack':92C 'byte':111C 'caus':108C 'contain':71C 'craft':96C 'cursor':86C,106C 'decod':79C,117C 'disclosur':74C 'fail':102C 'ffmpeg':68C 'frame':91C,101C 'heap':110C 'inform':73C 'later':90C 'libavcodec/vmnc.c':81C 'load':104C 'output':118C 'restor':83C 'save':87C 'screendta':113C 'shape':107C 'stream':98C 'suppli':94C 'uniniti':109C 'unwritten':85C 'vmnc':78C,97C 'vulner':75C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T19:16:51+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125101","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125101","severity":null,"published_at":"2026-11-09T19:16:51+00:00","modified_at":"2026-11-09T19:16:51+00:00","first_seen_at":"2026-11-09T19:28:16+00:00","fetched_at":"2026-11-09T19:28:16+00:00","note":null}],"documents":[{"id":109219,"url":"https://github.com/FFmpeg/FFmpeg/commit/50865f20b1f474e6b11735c88f668751bc9aa528","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109220,"url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-vmnc-decoder-uninitialized-heap-memory-disclosure","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}