CVE-2026-125176 · Runtime
NO FIX YET · SEE WHAT TO DO
FFmpeg through 9.0.2 reads past decompressed data in the flashsv decoder when a Flash Screen Video 2 block ends mid-pixel. An attacker who supplies such a file can leak heap memory into the decoded video frames.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Anything that decodes Flash Screen Video 2 content with FFmpeg's flashsv decoder, such as media pipelines that transcode user uploads. Systems that never decode FSV2 input are unlikely to be exposed. The sources do not say more.
Not affected if managed-hosting, no-flsv2-input
Who cares ffmpeg, media-processing, transcoding
ffmpeg -version9.0.2 is affected; the sources do not state a fixed versionFFmpeg through 9.0.2 contains an uninitialized memory read vulnerability in decode_hybrid() in libavcodec/flashsv.c that reads past decompressed data when decoding 15-bit color pixels. Attackers can supply a crafted Flash Screen Video 2 block whose inflated data ends mid-pixel to leak heap memory into decoded output frames.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.