CVE-2026-125179 · Package
NO FIX YET
A crafted Westwood VQA video file that omits or truncates its CBF0/CBFZ codebook chunk makes the FFmpeg VQA decoder render frames from leftover heap bytes. An attacker who gets a victim to open or process such a file can read uninitialized heap memory in the decoded output.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Systems that decode untrusted Westwood VQA files with FFmpeg's libavcodec are exposed, since the crafted file alone triggers the leak. Systems that never decode VQA files from outside sources can likely skip it; the sources do not say more.
Not affected if no-untrusted-vqa-input
Who cares ffmpeg, libavcodec, media-processing
ffmpeg -version; the sources say the issue applies through 9.0.2.No fix yet, per the sources.
FFmpeg through 9.0.2 contains an uninitialized memory vulnerability in the VQA video decoder in libavcodec/vqavideo.c that allows attackers to disclose heap memory via a crafted VQA file. Attackers can supply a Westwood VQA file omitting or truncating the CBF0/CBFZ codebook chunk, causing vqa_decode_frame() to render frames from leftover heap bytes visible in decoded output.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.