{"id":"CVE-2026-125177","kind":"vulnerability","aliases":["CVE-2026-125177"],"related":[],"title":"FFmpeg: crafted MSCC or SRGC video leaks uninitialized heap memory","description":"FFmpeg through 9.0.2 contains an information disclosure vulnerability in the MSCC/SRGC decoder in libavcodec/mscc.c that outputs uninitialized heap bytes when RLE data ends early. Attackers can craft an MSCC or SRGC stream, such as in AVI, whose RLE data terminates early so the decoded frame exposes leftover heap memory to viewers of the output.","summary":"FFmpeg's MSCC/SRGC decoder in libavcodec/mscc.c outputs uninitialized heap bytes when the RLE data ends early. A crafted AVI or other MSCC/SRGC stream can make the decoded frame expose leftover heap memory to whoever views the output.","severity":"medium","cvss":4.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ffmpeg","libavcodec","runtime","video-transcoding"],"not_affected_if":["mscc-srgc-codecs-unused","no-untrusted-video"],"how_to_check":"- Run `ffmpeg -version` and compare against the fixed release in the NVD and patch links.\n- Check whether your pipeline decodes untrusted MSCC or SRGC content (AVI files from users, uploads, transcoding services).","fix":null,"status":"open","published_at":"2026-11-09T19:16:52+00:00","first_seen_at":"2026-11-09T19:28:16+00:00","triaged_at":"2026-11-09T19:32:23+00:00","updated_at":"2026-11-09T19:32:23+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-09T19:32:23Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"FFmpeg: crafted MSCC or SRGC video leaks uninitialized heap memory","impact":"low","summary":"FFmpeg's MSCC/SRGC decoder in libavcodec/mscc.c outputs uninitialized heap bytes when the RLE data ends early. A crafted AVI or other MSCC/SRGC stream can make the decoded frame expose leftover heap memory to whoever views the output.","audience":"developers","category":"runtime","nicknames":[],"who_cares":["ffmpeg","libavcodec","video-transcoding"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Leftover heap memory bytes readable by viewers of decoded output","analyst_note":"Confirm the first fixed FFmpeg version from the linked patch on github.com and the VulnCheck advisory.","how_to_check":"- Run `ffmpeg -version` and compare against the fixed release in the NVD and patch links.\n- Check whether your pipeline decodes untrusted MSCC or SRGC content (AVI files from users, uploads, transcoding services).","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-untrusted-video","mscc-srgc-codecs-unused"],"who_is_affected":"Systems that run FFmpeg's libavcodec to decode untrusted video, such as upload-to-thumbnail or transcoding services, are exposed when they decode MSCC or SRGC streams. Desktop users who only play trusted local files are unlikely to be affected. unknown whether the sources list the exact fixed version.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000767,"input_tokens":4642,"output_tokens":605,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125177':13A,16A '-2026':12A,15A '9.0.2':62C 'attack':84C 'avi':41B,95C 'byte':32B,78C 'contain':63C 'craft':2A,40B,86C 'cve':11A,14A 'data':36B,81C,98C 'decod':26B,49B,71C,103C 'disclosur':66C 'earli':38B,83C,100C 'end':37B,82C 'expos':51B,105C 'ffmpeg':1A,17B,23B,60C 'frame':50B,104C 'heap':9A,31B,53B,77C,107C 'inform':65C 'leak':7A 'leftov':52B,106C 'libavcodec':18B 'libavcodec/mscc.c':28B,73C 'make':47B 'memori':10A,54B,108C 'mscc':3A,88C 'mscc/srgc':25B,44B,70C 'output':29B,59B,75C,113C 'rle':35B,80C,97C 'runtim':19B 'srgc':5A,90C 'stream':45B,91C 'termin':99C 'transcod':22B 'uniniti':8A,30B,76C 'video':6A,21B 'video-transcod':20B 'view':57B 'viewer':110C 'vulner':67C 'whoever':56B 'whose':96C","nicknames":[],"mitigations":[],"who_affected":"Systems that run FFmpeg's libavcodec to decode untrusted video, such as upload-to-thumbnail or transcoding services, are exposed when they decode MSCC or SRGC streams. Desktop users who only play trusted local files are unlikely to be affected. unknown whether the sources list the exact fixed version.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ffmpeg","libavcodec","medium","runtime","videotranscoding"],"campaign_type":null,"search_a":"'-125177':13A,16A '-2026':12A,15A 'craft':2A 'cve':11A,14A 'ffmpeg':1A 'heap':9A 'leak':7A 'memori':10A 'mscc':3A 'srgc':5A 'uniniti':8A 'video':6A","search_b":"'avi':41B 'byte':32B 'craft':40B 'data':36B 'decod':26B,49B 'earli':38B 'end':37B 'expos':51B 'ffmpeg':17B,23B 'frame':50B 'heap':31B,53B 'leftov':52B 'libavcodec':18B 'libavcodec/mscc.c':28B 'make':47B 'memori':54B 'mscc/srgc':25B,44B 'output':29B,59B 'rle':35B 'runtim':19B 'stream':45B 'transcod':22B 'uniniti':30B 'video':21B 'video-transcod':20B 'view':57B 'whoever':56B","search_c":"'9.0.2':62C 'attack':84C 'avi':95C 'byte':78C 'contain':63C 'craft':86C 'data':81C,98C 'decod':71C,103C 'disclosur':66C 'earli':83C,100C 'end':82C 'expos':105C 'ffmpeg':60C 'frame':104C 'heap':77C,107C 'inform':65C 'leftov':106C 'libavcodec/mscc.c':73C 'memori':108C 'mscc':88C 'mscc/srgc':70C 'output':75C,113C 'rle':80C,97C 'srgc':90C 'stream':91C 'termin':99C 'uniniti':76C 'viewer':110C 'vulner':67C 'whose':96C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T19:16:52+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125177","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125177","severity":null,"published_at":"2026-11-09T19:16:52+00:00","modified_at":"2026-11-09T19:16:52+00:00","first_seen_at":"2026-11-09T19:28:16+00:00","fetched_at":"2026-11-09T19:28:16+00:00","note":null}],"documents":[{"id":109242,"url":"https://github.com/FFmpeg/FFmpeg/commit/263a85e2a2127396f8a2b0c329ec798e1ea015ad","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109243,"url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-uninitialized-heap-memory-disclosure-via-mscc-srgc-decoder","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}