---
id: "CVE-2026-125177"
page: "https://infrastack.ai/live/CVE-2026-125177"
kind: "vulnerability"
aliases: ["CVE-2026-125177"]
title: "FFmpeg: crafted MSCC or SRGC video leaks uninitialized heap memory"
severity: "medium"
cvss: 4.8
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["ffmpeg", "libavcodec", "runtime", "video-transcoding"]
not_affected_if: ["mscc-srgc-codecs-unused", "no-untrusted-video"]
published_at: "2026-11-09T19:16:52+00:00"
first_seen_at: "2026-11-09T19:28:16+00:00"
updated_at: "2026-11-09T19:32:23+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-125177", "first_seen_at": "2026-11-09T19:28:16+00:00"}]
exploit_sources: []
---

# FFmpeg: crafted MSCC or SRGC video leaks uninitialized heap memory

Link for people: https://infrastack.ai/live/CVE-2026-125177 (this .md is for agents)

FFmpeg's MSCC/SRGC decoder in libavcodec/mscc.c outputs uninitialized heap bytes when the RLE data ends early. A crafted AVI or other MSCC/SRGC stream can make the decoded frame expose leftover heap memory to whoever views the output.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `ffmpeg -version` and compare against the fixed release in the NVD and patch links.
- Check whether your pipeline decodes untrusted MSCC or SRGC content (AVI files from users, uploads, transcoding services).

## Timeline

- 2026-11-09T19:28:16+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-125177

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-uninitialized-heap-memory-disclosure-via-mscc-srgc-decoder
- [fix] Patch: github.com https://github.com/FFmpeg/FFmpeg/commit/263a85e2a2127396f8a2b0c329ec798e1ea015ad

## From the sources

FFmpeg through 9.0.2 contains an information disclosure vulnerability in the MSCC/SRGC decoder in libavcodec/mscc.c that outputs uninitialized heap bytes when RLE data ends early. Attackers can craft an MSCC or SRGC stream, such as in AVI, whose RLE data terminates early so the decoded frame exposes leftover heap memory to viewers of the output.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_