{"id":"CVE-2026-125179","kind":"vulnerability","aliases":["CVE-2026-125179"],"related":[],"title":"FFmpeg: crafted VQA video file leaks heap memory into decoded output","description":"FFmpeg through 9.0.2 contains an uninitialized memory vulnerability in the VQA video decoder in libavcodec/vqavideo.c that allows attackers to disclose heap memory via a crafted VQA file. Attackers can supply a Westwood VQA file omitting or truncating the CBF0/CBFZ codebook chunk, causing vqa_decode_frame() to render frames from leftover heap bytes visible in decoded output.","summary":"A crafted Westwood VQA video file that omits or truncates its CBF0/CBFZ codebook chunk makes the FFmpeg VQA decoder render frames from leftover heap bytes. An attacker who gets a victim to open or process such a file can read uninitialized heap memory in the decoded output.","severity":"medium","cvss":4.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ffmpeg","libavcodec","media-processing","package"],"not_affected_if":["no-untrusted-vqa-input"],"how_to_check":"- Check the installed FFmpeg version with `ffmpeg -version`; the sources say the issue applies through `9.0.2`.\n- Look for applications that decode untrusted VQA files with libavcodec.","fix":null,"status":"open","published_at":"2026-11-09T19:16:53+00:00","first_seen_at":"2026-11-09T19:28:16+00:00","triaged_at":"2026-11-09T19:32:21+00:00","updated_at":"2026-11-09T19:32:21+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-09T19:32:21Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"FFmpeg: crafted VQA video file leaks heap memory into decoded output","impact":"low","summary":"A crafted Westwood VQA video file that omits or truncates its CBF0/CBFZ codebook chunk makes the FFmpeg VQA decoder render frames from leftover heap bytes. An attacker who gets a victim to open or process such a file can read uninitialized heap memory in the decoded output.","audience":"businesses","category":"package","nicknames":[],"who_cares":["ffmpeg","libavcodec","media-processing"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"heap memory contents disclosed through decoded video frames","analyst_note":"Confirm the fixed FFmpeg version and whether the patch link on github.com covers this CVE; the sources give no fixed version.","how_to_check":"- Check the installed FFmpeg version with `ffmpeg -version`; the sources say the issue applies through `9.0.2`.\n- Look for applications that decode untrusted VQA files with libavcodec.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-untrusted-vqa-input"],"who_is_affected":"Systems that decode untrusted Westwood VQA files with FFmpeg's libavcodec are exposed, since the crafted file alone triggers the leak. Systems that never decode VQA files from outside sources can likely skip it; the sources do not say more.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000741,"input_tokens":4640,"output_tokens":554,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125179':14A,17A '-2026':13A,16A '9.0.2':73C 'allow':87C 'attack':50B,88C,98C 'byte':48B,122C 'caus':112C 'cbf0/cbfz':35B,109C 'chunk':37B,111C 'codebook':36B,110C 'contain':74C 'craft':2A,25B,95C 'cve':12A,15A 'decod':10A,42B,69B,83C,114C,125C 'disclos':90C 'ffmpeg':1A,18B,40B,71C 'file':5A,29B,61B,97C,104C 'frame':44B,115C,118C 'get':52B 'heap':7A,47B,65B,91C,121C 'leak':6A 'leftov':46B,120C 'libavcodec':19B 'libavcodec/vqavideo.c':85C 'make':38B 'media':21B 'media-process':20B 'memori':8A,66B,77C,92C 'omit':31B,105C 'open':56B 'output':11A,70B,126C 'packag':23B 'process':22B,58B 'read':63B 'render':43B,117C 'suppli':100C 'truncat':33B,107C 'uniniti':64B,76C 'via':93C 'victim':54B 'video':4A,28B,82C 'visibl':123C 'vqa':3A,27B,41B,81C,96C,103C,113C 'vulner':78C 'westwood':26B,102C","nicknames":[],"mitigations":[],"who_affected":"Systems that decode untrusted Westwood VQA files with FFmpeg's libavcodec are exposed, since the crafted file alone triggers the leak. Systems that never decode VQA files from outside sources can likely skip it; the sources do not say more.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ffmpeg","libavcodec","mediaprocessing","medium","package"],"campaign_type":null,"search_a":"'-125179':14A,17A '-2026':13A,16A 'craft':2A 'cve':12A,15A 'decod':10A 'ffmpeg':1A 'file':5A 'heap':7A 'leak':6A 'memori':8A 'output':11A 'video':4A 'vqa':3A","search_b":"'attack':50B 'byte':48B 'cbf0/cbfz':35B 'chunk':37B 'codebook':36B 'craft':25B 'decod':42B,69B 'ffmpeg':18B,40B 'file':29B,61B 'frame':44B 'get':52B 'heap':47B,65B 'leftov':46B 'libavcodec':19B 'make':38B 'media':21B 'media-process':20B 'memori':66B 'omit':31B 'open':56B 'output':70B 'packag':23B 'process':22B,58B 'read':63B 'render':43B 'truncat':33B 'uniniti':64B 'victim':54B 'video':28B 'vqa':27B,41B 'westwood':26B","search_c":"'9.0.2':73C 'allow':87C 'attack':88C,98C 'byte':122C 'caus':112C 'cbf0/cbfz':109C 'chunk':111C 'codebook':110C 'contain':74C 'craft':95C 'decod':83C,114C,125C 'disclos':90C 'ffmpeg':71C 'file':97C,104C 'frame':115C,118C 'heap':91C,121C 'leftov':120C 'libavcodec/vqavideo.c':85C 'memori':77C,92C 'omit':105C 'output':126C 'render':117C 'suppli':100C 'truncat':107C 'uniniti':76C 'via':93C 'video':82C 'visibl':123C 'vqa':81C,96C,103C,113C 'vulner':78C 'westwood':102C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T19:16:53+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125179","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125179","severity":null,"published_at":"2026-11-09T19:16:53+00:00","modified_at":"2026-11-09T19:16:53+00:00","first_seen_at":"2026-11-09T19:28:16+00:00","fetched_at":"2026-11-09T19:28:16+00:00","note":null}],"documents":[{"id":109246,"url":"https://github.com/FFmpeg/FFmpeg/commit/f9df3577ac40aaee06f82f05eab8249cbab3cd33","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109247,"url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-heap-memory-disclosure-via-vqa-video-decoder","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}