CVE-2026-125177 · Runtime
NO FIX YET
FFmpeg's MSCC/SRGC decoder in libavcodec/mscc.c outputs uninitialized heap bytes when the RLE data ends early. A crafted AVI or other MSCC/SRGC stream can make the decoded frame expose leftover heap memory to whoever views the output.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Systems that run FFmpeg's libavcodec to decode untrusted video, such as upload-to-thumbnail or transcoding services, are exposed when they decode MSCC or SRGC streams. Desktop users who only play trusted local files are unlikely to be affected. unknown whether the sources list the exact fixed version.
Not affected if mscc-srgc-codecs-unused, no-untrusted-video
Who cares ffmpeg, libavcodec, video-transcoding
ffmpeg -version and compare against the fixed release in the NVD and patch links.No fix yet, per the sources.
FFmpeg through 9.0.2 contains an information disclosure vulnerability in the MSCC/SRGC decoder in libavcodec/mscc.c that outputs uninitialized heap bytes when RLE data ends early. Attackers can craft an MSCC or SRGC stream, such as in AVI, whose RLE data terminates early so the decoded frame exposes leftover heap memory to viewers of the output.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.