{"id":"CVE-2026-125102","kind":"vulnerability","aliases":["CVE-2026-125102"],"related":[],"title":"FFmpeg: crafted TAK audio file leaks uninitialized heap memory through decoded audio","description":"FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in tak_decode_frame() in libavcodec/takdec.c that fails to verify multichannel decorrelation lists cover every channel. Attackers can supply crafted multichannel TAK files omitting channels from the list, causing undecoded sample buffers to leak heap memory through decoded audio.","summary":"FFmpeg through 9.0.2 fails to check that multichannel decorrelation lists in TAK audio files cover every channel. A crafted file can leave some sample buffers undecoded, so heap memory leaks into the decoded audio output.","severity":"medium","cvss":4.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ffmpeg","libavcodec","media-processing","runtime"],"not_affected_if":["no-tak-decoding","trusted-input-only"],"how_to_check":"- Run `ffmpeg -version` and compare against the fixed version (unknown from the sources given)\n- Check whether your pipeline decodes untrusted TAK (.tak) files with libavcodec","fix":null,"status":"open","published_at":"2026-11-09T19:16:51+00:00","first_seen_at":"2026-11-09T19:28:16+00:00","triaged_at":"2026-11-09T19:32:27+00:00","updated_at":"2026-11-09T19:32:27+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-09T19:32:27Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"FFmpeg: crafted TAK audio file leaks uninitialized heap memory through decoded audio","impact":"low","summary":"FFmpeg through 9.0.2 fails to check that multichannel decorrelation lists in TAK audio files cover every channel. A crafted file can leave some sample buffers undecoded, so heap memory leaks into the decoded audio output.","audience":"developers","category":"runtime","nicknames":[],"who_cares":["ffmpeg","libavcodec","media-processing"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"heap memory contents leak through decoded audio output","analyst_note":"Confirm the fixed FFmpeg version and check the patch and VulnCheck advisory linked from the signal.","how_to_check":"- Run `ffmpeg -version` and compare against the fixed version (unknown from the sources given)\n- Check whether your pipeline decodes untrusted TAK (.tak) files with libavcodec","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["trusted-input-only","no-tak-decoding"],"who_is_affected":"Systems that decode TAK audio from untrusted sources with FFmpeg or libavcodec are the ones exposed. Setups that only process trusted media or never decode TAK files can skip it. The sources do not name a fixed version; the linked patch is the place to confirm it.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000734,"input_tokens":4625,"output_tokens":543,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125102':15A,18A '-2026':14A,17A '9.0.2':27B,62C 'attack':85C 'audio':4A,12A,37B,58B,107C 'buffer':49B,100C 'caus':97C 'channel':41B,84C,93C 'check':30B 'contain':63C 'cover':39B,82C 'craft':2A,43B,88C 'cve':13A,16A 'decod':11A,57B,71C,106C 'decorrel':33B,80C 'disclosur':67C 'everi':40B,83C 'fail':28B,76C 'ffmpeg':1A,19B,25B,60C 'file':5A,38B,44B,91C 'frame':72C 'heap':8A,52B,103C 'leak':6A,54B,102C 'leav':46B 'libavcodec':20B 'libavcodec/takdec.c':74C 'list':34B,81C,96C 'media':22B 'media-process':21B 'memori':9A,53B,66C,104C 'multichannel':32B,79C,89C 'omit':92C 'output':59B 'process':23B 'runtim':24B 'sampl':48B,99C 'suppli':87C 'tak':3A,36B,70C,90C 'undecod':50B,98C 'uniniti':7A,65C 'verifi':78C 'vulner':68C","nicknames":[],"mitigations":[],"who_affected":"Systems that decode TAK audio from untrusted sources with FFmpeg or libavcodec are the ones exposed. Setups that only process trusted media or never decode TAK files can skip it. The sources do not name a fixed version; the linked patch is the place to confirm it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ffmpeg","libavcodec","mediaprocessing","medium","runtime"],"campaign_type":null,"search_a":"'-125102':15A,18A '-2026':14A,17A 'audio':4A,12A 'craft':2A 'cve':13A,16A 'decod':11A 'ffmpeg':1A 'file':5A 'heap':8A 'leak':6A 'memori':9A 'tak':3A 'uniniti':7A","search_b":"'9.0.2':27B 'audio':37B,58B 'buffer':49B 'channel':41B 'check':30B 'cover':39B 'craft':43B 'decod':57B 'decorrel':33B 'everi':40B 'fail':28B 'ffmpeg':19B,25B 'file':38B,44B 'heap':52B 'leak':54B 'leav':46B 'libavcodec':20B 'list':34B 'media':22B 'media-process':21B 'memori':53B 'multichannel':32B 'output':59B 'process':23B 'runtim':24B 'sampl':48B 'tak':36B 'undecod':50B","search_c":"'9.0.2':62C 'attack':85C 'audio':107C 'buffer':100C 'caus':97C 'channel':84C,93C 'contain':63C 'cover':82C 'craft':88C 'decod':71C,106C 'decorrel':80C 'disclosur':67C 'everi':83C 'fail':76C 'ffmpeg':60C 'file':91C 'frame':72C 'heap':103C 'leak':102C 'libavcodec/takdec.c':74C 'list':81C,96C 'memori':66C,104C 'multichannel':79C,89C 'omit':92C 'sampl':99C 'suppli':87C 'tak':70C,90C 'undecod':98C 'uniniti':65C 'verifi':78C 'vulner':68C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T19:16:51+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125102","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125102","severity":null,"published_at":"2026-11-09T19:16:51+00:00","modified_at":"2026-11-09T19:16:51+00:00","first_seen_at":"2026-11-09T19:28:16+00:00","fetched_at":"2026-11-09T19:28:16+00:00","note":null}],"documents":[{"id":109221,"url":"https://github.com/FFmpeg/FFmpeg/commit/01e1bb126179879201429952cc2dcaea0d50d603","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109222,"url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-tak-decoder-uninitialized-memory-disclosure-via-takdec-c","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}