CVE-2026-125190 · Package
NO FIX YET
FFmpeg through 9.0.2 has an out-of-bounds palette read in its MVC2 decoder in libavcodec/mvcdec.c. A crafted MVC2 stream can copy uninitialized stack memory into decoded RGB frames, which can expose process memory contents.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
FFmpeg versions through 9.0.2 are affected when they decode MVC2 streams from untrusted sources, such as user uploads or remote media. Systems that only process trusted or locally produced media are less exposed. The sources reference a patch on GitHub but do not state the fixed version number.
Not affected if no-mvc2-decoding, trusted-input-only
Who cares ffmpeg, libavcodec, media-processing, self-hosted
ffmpeg -version and compare the version against the fixed release in the sources, which is unknown here.No fix yet, per the sources.
FFmpeg through 9.0.2 contains an information disclosure vulnerability in decode_mvc2() in libavcodec/mvcdec.c that leaks uninitialized stack memory through unchecked palette indices. Attackers can supply a crafted MVC2 stream declaring few colors but referencing higher palette indices, copying process stack contents into decoded RGB frames.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.