CVE-2026-125184 · Runtime
NO FIX YET · SEE WHAT TO DO
FFmpeg's CamStudio (CSCD) decoder copies uninitialized heap memory into decoded frames when a compressed payload decompresses to fewer bytes than the frame size. An attacker who supplies a crafted AVI file can recover heap contents from the decoded or re-encoded output.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Systems that run FFmpeg 6.1 through 9.0.2 and decode AVI files from untrusted sources, such as media-processing services, transcoding pipelines or upload-handling apps. Teams that only process their own media or do not accept external AVI files are at much lower risk. The sources do not describe default-enabled or disabled decoder behavior.
Not affected if ffmpeg-outside-6.1-9.0.2, no-untrusted-avi-input
Who cares ffmpeg, media-processing, self-hosted, transcoding
ffmpeg -version; affected releases are 6.1 through 9.0.2.9.0.2; the sources do not name the exact fixed version.FFmpeg 6.1 through 9.0.2 contains an information disclosure vulnerability in the CamStudio decoder (libavcodec/cscd.c) that copies uninitialized heap memory into decoded frames when decompressed payloads are short. Attackers can supply a crafted AVI with a CSCD stream whose LZO or zlib frames decompress to fewer bytes than the frame size, recovering heap contents from the decoded or re-encoded output.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.