CVE-2026-125102 · Runtime
NO FIX YET
FFmpeg through 9.0.2 fails to check that multichannel decorrelation lists in TAK audio files cover every channel. A crafted file can leave some sample buffers undecoded, so heap memory leaks into the decoded audio output.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Systems that decode TAK audio from untrusted sources with FFmpeg or libavcodec are the ones exposed. Setups that only process trusted media or never decode TAK files can skip it. The sources do not name a fixed version; the linked patch is the place to confirm it.
Not affected if no-tak-decoding, trusted-input-only
Who cares ffmpeg, libavcodec, media-processing
ffmpeg -version and compare against the fixed version (unknown from the sources given)No fix yet, per the sources.
FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in tak_decode_frame() in libavcodec/takdec.c that fails to verify multichannel decorrelation lists cover every channel. Attackers can supply crafted multichannel TAK files omitting channels from the list, causing undecoded sample buffers to leak heap memory through decoded audio.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.