{"id":"CVE-2026-125184","kind":"vulnerability","aliases":["CVE-2026-125184"],"related":[],"title":"FFmpeg: CamStudio decoder leaks uninitialized heap memory into decoded video","description":"FFmpeg 6.1 through 9.0.2 contains an information disclosure vulnerability in the CamStudio decoder (libavcodec/cscd.c) that copies uninitialized heap memory into decoded frames when decompressed payloads are short. Attackers can supply a crafted AVI with a CSCD stream whose LZO or zlib frames decompress to fewer bytes than the frame size, recovering heap contents from the decoded or re-encoded output.","summary":"FFmpeg's CamStudio (CSCD) decoder copies uninitialized heap memory into decoded frames when a compressed payload decompresses to fewer bytes than the frame size. An attacker who supplies a crafted AVI file can recover heap contents from the decoded or re-encoded output.","severity":"medium","cvss":4.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ffmpeg","media-processing","runtime","self-hosted","transcoding"],"not_affected_if":["ffmpeg-outside-6.1-9.0.2","no-untrusted-avi-input"],"how_to_check":"- Check the installed FFmpeg version with `ffmpeg -version`; affected releases are `6.1` through `9.0.2`.\n- Check whether your application decodes untrusted AVI files using the CamStudio codec (CSCD).","fix":"- Move to a FFmpeg release newer than `9.0.2`; the sources do not name the exact fixed version.","status":"open","published_at":"2026-11-09T19:16:53+00:00","first_seen_at":"2026-11-09T19:28:17+00:00","triaged_at":"2026-11-09T19:32:18+00:00","updated_at":"2026-11-09T19:32:18+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-09T19:32:18Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a FFmpeg release newer than `9.0.2`; the sources do not name the exact fixed version.","reach":"internet","title":"FFmpeg: CamStudio decoder leaks uninitialized heap memory into decoded video","impact":"low","summary":"FFmpeg's CamStudio (CSCD) decoder copies uninitialized heap memory into decoded frames when a compressed payload decompresses to fewer bytes than the frame size. An attacker who supplies a crafted AVI file can recover heap contents from the decoded or re-encoded output.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["ffmpeg","media-processing","transcoding","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Heap memory contents leak into decoded output files","analyst_note":"Confirm the fixed FFmpeg version and whether the CSCD decoder is built by default, using the NVD entry and the linked github.com patch and vulncheck advisory.","how_to_check":"- Check the installed FFmpeg version with `ffmpeg -version`; affected releases are `6.1` through `9.0.2`.\n- Check whether your application decodes untrusted AVI files using the CamStudio codec (CSCD).","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-untrusted-avi-input","ffmpeg-outside-6.1-9.0.2"],"who_is_affected":"Systems that run FFmpeg 6.1 through 9.0.2 and decode AVI files from untrusted sources, such as media-processing services, transcoding pipelines or upload-handling apps. Teams that only process their own media or do not accept external AVI files are at much lower risk. The sources do not describe default-enabled or disabled decoder behavior.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000801,"input_tokens":4646,"output_tokens":673,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125184':13A,16A '-2026':12A,15A '6.1':71C '9.0.2':73C 'attack':51B,97C 'avi':56B,102C 'byte':45B,115C 'camstudio':2A,28B,81C 'compress':40B 'contain':74C 'content':61B,122C 'copi':31B,85C 'craft':55B,101C 'cscd':29B,105C 'cve':11A,14A 'decod':3A,9A,30B,36B,64B,82C,90C,125C 'decompress':42B,93C,112C 'disclosur':77C 'encod':68B,129C 'fewer':44B,114C 'ffmpeg':1A,17B,26B,70C 'file':57B 'frame':37B,48B,91C,111C,118C 'heap':6A,33B,60B,87C,121C 'host':24B 'inform':76C 'leak':4A 'libavcodec/cscd.c':83C 'lzo':108C 'media':19B 'media-process':18B 'memori':7A,34B,88C 'output':69B,130C 'payload':41B,94C 'process':20B 're':67B,128C 're-encod':66B,127C 'recov':59B,120C 'runtim':21B 'self':23B 'self-host':22B 'short':96C 'size':49B,119C 'stream':106C 'suppli':53B,99C 'transcod':25B 'uniniti':5A,32B,86C 'video':10A 'vulner':78C 'whose':107C 'zlib':110C","nicknames":[],"mitigations":[],"who_affected":"Systems that run FFmpeg 6.1 through 9.0.2 and decode AVI files from untrusted sources, such as media-processing services, transcoding pipelines or upload-handling apps. Teams that only process their own media or do not accept external AVI files are at much lower risk. The sources do not describe default-enabled or disabled decoder behavior.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ffmpeg","mediaprocessing","medium","runtime","selfhosted","transcoding"],"campaign_type":null,"search_a":"'-125184':13A,16A '-2026':12A,15A 'camstudio':2A 'cve':11A,14A 'decod':3A,9A 'ffmpeg':1A 'heap':6A 'leak':4A 'memori':7A 'uniniti':5A 'video':10A","search_b":"'attack':51B 'avi':56B 'byte':45B 'camstudio':28B 'compress':40B 'content':61B 'copi':31B 'craft':55B 'cscd':29B 'decod':30B,36B,64B 'decompress':42B 'encod':68B 'fewer':44B 'ffmpeg':17B,26B 'file':57B 'frame':37B,48B 'heap':33B,60B 'host':24B 'media':19B 'media-process':18B 'memori':34B 'output':69B 'payload':41B 'process':20B 're':67B 're-encod':66B 'recov':59B 'runtim':21B 'self':23B 'self-host':22B 'size':49B 'suppli':53B 'transcod':25B 'uniniti':32B","search_c":"'6.1':71C '9.0.2':73C 'attack':97C 'avi':102C 'byte':115C 'camstudio':81C 'contain':74C 'content':122C 'copi':85C 'craft':101C 'cscd':105C 'decod':82C,90C,125C 'decompress':93C,112C 'disclosur':77C 'encod':129C 'fewer':114C 'ffmpeg':70C 'frame':91C,111C,118C 'heap':87C,121C 'inform':76C 'libavcodec/cscd.c':83C 'lzo':108C 'memori':88C 'output':130C 'payload':94C 're':128C 're-encod':127C 'recov':120C 'short':96C 'size':119C 'stream':106C 'suppli':99C 'uniniti':86C 'vulner':78C 'whose':107C 'zlib':110C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T19:16:53+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125184","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125184","severity":null,"published_at":"2026-11-09T19:16:53+00:00","modified_at":"2026-11-09T19:16:53+00:00","first_seen_at":"2026-11-09T19:28:17+00:00","fetched_at":"2026-11-09T19:28:17+00:00","note":null}],"documents":[{"id":109258,"url":"https://github.com/FFmpeg/FFmpeg/commit/e58c4eb98f0f3c0523089fb9d037eedfcbd204d9","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109259,"url":"https://www.vulncheck.com/advisories/ffmpeg-6.1-through-9.0.2-information-disclosure-via-camstudio-decoder-cscd-c","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}