{"id":"CVE-2026-125175","kind":"vulnerability","aliases":["CVE-2026-125175"],"related":[],"title":"FFmpeg: crafted FLV file leaks uninitialized heap memory into video output","description":"FFmpeg through 9.0.2 contains an information disclosure vulnerability in flashsv_decode_block() in libavcodec/flashsv.c that copies uninitialized heap memory into decoded frames when inflate output is short. Attackers can supply a crafted FLV with an FSV1 stream whose zlib block data decompresses short, then recover heap contents from the decoded or re-encoded output.","summary":"FFmpeg's Flash Screen Video decoder copies uninitialized heap memory into decoded frames when zlib output is short. An attacker who supplies a crafted FLV file can recover heap contents from the decoded or re-encoded output.","severity":"medium","cvss":4.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ffmpeg","media-processing","package","self-hosted"],"not_affected_if":["no-flv-decoding","trusted-input-only"],"how_to_check":"- Check the installed FFmpeg version with `ffmpeg -version`; the sources say versions through 9.0.2 are affected.\n- Look for FLV/FSV1 (Flash Screen Video) decoding in pipelines that process untrusted uploads.","fix":"- FFmpeg patches are linked from the sources (github.com); fixed version numbers are unknown.","status":"open","published_at":"2026-11-09T19:16:52+00:00","first_seen_at":"2026-11-09T19:28:16+00:00","triaged_at":"2026-11-09T19:32:25+00:00","updated_at":"2026-11-09T19:32:25+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-09T19:32:25Z","model":"claude-haiku-5-5","output":{"fix":"- FFmpeg patches are linked from the sources (github.com); fixed version numbers are unknown.","reach":"unknown","title":"FFmpeg: crafted FLV file leaks uninitialized heap memory into video output","impact":"low","summary":"FFmpeg's Flash Screen Video decoder copies uninitialized heap memory into decoded frames when zlib output is short. An attacker who supplies a crafted FLV file can recover heap contents from the decoded or re-encoded output.","audience":"businesses","category":"package","nicknames":[],"who_cares":["ffmpeg","media-processing","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"Heap memory contents leak into decoded output readable by the attacker","analyst_note":"Confirm the fixed FFmpeg version from the linked github.com patch commits and the vulncheck advisory; the sources do not name it.","how_to_check":"- Check the installed FFmpeg version with `ffmpeg -version`; the sources say versions through 9.0.2 are affected.\n- Look for FLV/FSV1 (Flash Screen Video) decoding in pipelines that process untrusted uploads.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-flv-decoding","trusted-input-only"],"who_is_affected":"Systems that run FFmpeg to decode or transcode FLV files supplied by untrusted users, such as media upload or conversion services, are exposed. Deployments that never decode FLV or Flash Screen Video content can skip it.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000757,"input_tokens":4636,"output_tokens":586,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125175':14A,17A '-2026':13A,16A '9.0.2':66C 'attack':45B,91C 'block':75C,103C 'contain':67C 'content':55B,110C 'copi':32B,79C 'craft':2A,49B,95C 'cve':12A,15A 'data':104C 'decod':31B,37B,58B,74C,84C,113C 'decompress':105C 'disclosur':70C 'encod':62B,117C 'ffmpeg':1A,18B,26B,64C 'file':4A,51B 'flash':28B 'flashsv':73C 'flv':3A,50B,96C 'frame':38B,85C 'fsv1':99C 'heap':7A,34B,54B,81C,109C 'host':25B 'inflat':87C 'inform':69C 'leak':5A 'libavcodec/flashsv.c':77C 'media':20B 'media-process':19B 'memori':8A,35B,82C 'output':11A,41B,63B,88C,118C 'packag':22B 'process':21B 're':61B,116C 're-encod':60B,115C 'recov':53B,108C 'screen':29B 'self':24B 'self-host':23B 'short':43B,90C,106C 'stream':100C 'suppli':47B,93C 'uniniti':6A,33B,80C 'video':10A,30B 'vulner':71C 'whose':101C 'zlib':40B,102C","nicknames":[],"mitigations":[],"who_affected":"Systems that run FFmpeg to decode or transcode FLV files supplied by untrusted users, such as media upload or conversion services, are exposed. Deployments that never decode FLV or Flash Screen Video content can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ffmpeg","mediaprocessing","medium","package","selfhosted"],"campaign_type":null,"search_a":"'-125175':14A,17A '-2026':13A,16A 'craft':2A 'cve':12A,15A 'ffmpeg':1A 'file':4A 'flv':3A 'heap':7A 'leak':5A 'memori':8A 'output':11A 'uniniti':6A 'video':10A","search_b":"'attack':45B 'content':55B 'copi':32B 'craft':49B 'decod':31B,37B,58B 'encod':62B 'ffmpeg':18B,26B 'file':51B 'flash':28B 'flv':50B 'frame':38B 'heap':34B,54B 'host':25B 'media':20B 'media-process':19B 'memori':35B 'output':41B,63B 'packag':22B 'process':21B 're':61B 're-encod':60B 'recov':53B 'screen':29B 'self':24B 'self-host':23B 'short':43B 'suppli':47B 'uniniti':33B 'video':30B 'zlib':40B","search_c":"'9.0.2':66C 'attack':91C 'block':75C,103C 'contain':67C 'content':110C 'copi':79C 'craft':95C 'data':104C 'decod':74C,84C,113C 'decompress':105C 'disclosur':70C 'encod':117C 'ffmpeg':64C 'flashsv':73C 'flv':96C 'frame':85C 'fsv1':99C 'heap':81C,109C 'inflat':87C 'inform':69C 'libavcodec/flashsv.c':77C 'memori':82C 'output':88C,118C 're':116C 're-encod':115C 'recov':108C 'short':90C,106C 'stream':100C 'suppli':93C 'uniniti':80C 'vulner':71C 'whose':101C 'zlib':102C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T19:16:52+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125175","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125175","severity":null,"published_at":"2026-11-09T19:16:52+00:00","modified_at":"2026-11-09T19:16:52+00:00","first_seen_at":"2026-11-09T19:28:16+00:00","fetched_at":"2026-11-09T19:28:16+00:00","note":null}],"documents":[{"id":109237,"url":"https://github.com/FFmpeg/FFmpeg/commit/50d206a75b5e60261d71b25657ae04891eb60290","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109238,"url":"https://github.com/FFmpeg/FFmpeg/commit/cfb40c912927fdd2c1186b7b6aca468422da23db","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109239,"url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-information-disclosure-via-flash-screen-video-decoder","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}