CVE-2026-125171 · Package
NO FIX YET
FFmpeg's Musepack SV7 decoder does not check the declared size of the final frame, so a crafted file makes it read past the audio buffer. An attacker can crash a program that decodes the file or leak heap memory.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications that pass untrusted Musepack SV7 files to FFmpeg for decoding, such as media converters, upload-processing pipelines and thumbnailers. Systems that only decode trusted local files or never handle Musepack can skip it. The sources do not name a fixed version.
Not affected if no-musepack-input, trusted-files-only
Who cares ffmpeg, media-processing, self-hosted
ffmpeg -version and compare against the fixed release named in the linked patch.No fix yet, per the sources.
FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in the Musepack SV7 decoder because mpc7_decode_init() does not validate lastframelen against MPC_FRAME_SIZE. Attackers can supply a crafted Musepack SV7 file declaring an oversized final frame, causing consumers of decoded frames to read past the audio buffer, leading to crashes or heap memory disclosure.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.