CVE-2026-125175 · Package
NO FIX YET · SEE WHAT TO DO
FFmpeg's Flash Screen Video decoder copies uninitialized heap memory into decoded frames when zlib output is short. An attacker who supplies a crafted FLV file can recover heap contents from the decoded or re-encoded output.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Systems that run FFmpeg to decode or transcode FLV files supplied by untrusted users, such as media upload or conversion services, are exposed. Deployments that never decode FLV or Flash Screen Video content can skip it.
Not affected if no-flv-decoding, trusted-input-only
Who cares ffmpeg, media-processing, self-hosted
ffmpeg -version; the sources say versions through 9.0.2 are affected.FFmpeg through 9.0.2 contains an information disclosure vulnerability in flashsv_decode_block() in libavcodec/flashsv.c that copies uninitialized heap memory into decoded frames when inflate output is short. Attackers can supply a crafted FLV with an FSV1 stream whose zlib block data decompresses short, then recover heap contents from the decoded or re-encoded output.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.