FFMPEG · CVE-2026-125103 · Runtime
NO FIX YET
FFmpeg's MLZ decompression in libavcodec accepts string codes beyond the dictionary's next free code, so a crafted MPEG-4 ALS file can make it copy uninitialized heap bytes into decoded audio output. An attacker who gets a victim to decode such a file can read leftover memory contents.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Systems that decode MPEG-4 ALS audio from untrusted sources with FFmpeg's libavcodec, such as transcoding services or media pipelines that accept user uploads. Desktop use of FFmpeg on files you trust is lower risk. unknown whether a patched version exists in the sources.
Not affected if no-als-decoding, trusted-input-only
Who cares ffmpeg, libavcodec, media-processing
ffmpeg -version; the sources say the flaw is in releases through 9.0.2.No fix yet, per the sources.
FFmpeg through 9.0.2 contains an information disclosure vulnerability in ff_mlz_decompression() in libavcodec/mlz.c, which accepts string codes beyond the dictionary's next free code. Attackers can supply a crafted MPEG-4 ALS file with malformed initial or out-of-range codes to copy uninitialized heap bytes into decoded audio output.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.