{"id":"CVE-2026-125190","kind":"vulnerability","aliases":["CVE-2026-125190"],"related":[],"title":"FFmpeg: crafted MVC2 video leaks process stack memory into frames","description":"FFmpeg through 9.0.2 contains an information disclosure vulnerability in decode_mvc2() in libavcodec/mvcdec.c that leaks uninitialized stack memory through unchecked palette indices. Attackers can supply a crafted MVC2 stream declaring few colors but referencing higher palette indices, copying process stack contents into decoded RGB frames.","summary":"FFmpeg through 9.0.2 has an out-of-bounds palette read in its MVC2 decoder in libavcodec/mvcdec.c. A crafted MVC2 stream can copy uninitialized stack memory into decoded RGB frames, which can expose process memory contents.","severity":"medium","cvss":4.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ffmpeg","libavcodec","media-processing","package","self-hosted"],"not_affected_if":["no-mvc2-decoding","trusted-input-only"],"how_to_check":"- Run `ffmpeg -version` and compare the version against the fixed release in the sources, which is unknown here.\n- Check whether your services decode untrusted MVC2 input, which the sources do not otherwise detail.","fix":null,"status":"open","published_at":"2026-11-09T19:16:54+00:00","first_seen_at":"2026-11-09T19:28:17+00:00","triaged_at":"2026-11-09T19:32:18+00:00","updated_at":"2026-11-09T19:32:18+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-09T19:32:18Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"FFmpeg: crafted MVC2 video leaks process stack memory into frames","impact":"low","summary":"FFmpeg through 9.0.2 has an out-of-bounds palette read in its MVC2 decoder in libavcodec/mvcdec.c. A crafted MVC2 stream can copy uninitialized stack memory into decoded RGB frames, which can expose process memory contents.","audience":"businesses","category":"package","nicknames":[],"who_cares":["ffmpeg","libavcodec","media-processing","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"process stack memory leaks into decoded video output","analyst_note":"Confirm the fixed FFmpeg version and whether MVC2 decoding is enabled by default, using the linked GitHub patch and the NVD entry.","how_to_check":"- Run `ffmpeg -version` and compare the version against the fixed release in the sources, which is unknown here.\n- Check whether your services decode untrusted MVC2 input, which the sources do not otherwise detail.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["trusted-input-only","no-mvc2-decoding"],"who_is_affected":"FFmpeg versions through 9.0.2 are affected when they decode MVC2 streams from untrusted sources, such as user uploads or remote media. Systems that only process trusted or locally produced media are less exposed. The sources reference a patch on GitHub but do not state the fixed version number.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000751,"input_tokens":4627,"output_tokens":577,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125190':13A,16A '-2026':12A,15A '9.0.2':28B,64C 'attack':84C 'bound':34B 'color':93C 'contain':65C 'content':61B,102C 'copi':48B,99C 'craft':2A,44B,88C 'cve':11A,14A 'declar':91C 'decod':40B,53B,71C,104C 'disclosur':68C 'expos':58B 'ffmpeg':1A,17B,26B,62C 'frame':10A,55B,106C 'higher':96C 'host':25B 'indic':83C,98C 'inform':67C 'leak':5A,76C 'libavcodec':18B 'libavcodec/mvcdec.c':42B,74C 'media':20B 'media-process':19B 'memori':8A,51B,60B,79C 'mvc2':3A,39B,45B,72C,89C 'out-of-bound':31B 'packag':22B 'palett':35B,82C,97C 'process':6A,21B,59B,100C 'read':36B 'referenc':95C 'rgb':54B,105C 'self':24B 'self-host':23B 'stack':7A,50B,78C,101C 'stream':46B,90C 'suppli':86C 'uncheck':81C 'uniniti':49B,77C 'video':4A 'vulner':69C","nicknames":[],"mitigations":[],"who_affected":"FFmpeg versions through 9.0.2 are affected when they decode MVC2 streams from untrusted sources, such as user uploads or remote media. Systems that only process trusted or locally produced media are less exposed. The sources reference a patch on GitHub but do not state the fixed version number.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ffmpeg","libavcodec","mediaprocessing","medium","package","selfhosted"],"campaign_type":null,"search_a":"'-125190':13A,16A '-2026':12A,15A 'craft':2A 'cve':11A,14A 'ffmpeg':1A 'frame':10A 'leak':5A 'memori':8A 'mvc2':3A 'process':6A 'stack':7A 'video':4A","search_b":"'9.0.2':28B 'bound':34B 'content':61B 'copi':48B 'craft':44B 'decod':40B,53B 'expos':58B 'ffmpeg':17B,26B 'frame':55B 'host':25B 'libavcodec':18B 'libavcodec/mvcdec.c':42B 'media':20B 'media-process':19B 'memori':51B,60B 'mvc2':39B,45B 'out-of-bound':31B 'packag':22B 'palett':35B 'process':21B,59B 'read':36B 'rgb':54B 'self':24B 'self-host':23B 'stack':50B 'stream':46B 'uniniti':49B","search_c":"'9.0.2':64C 'attack':84C 'color':93C 'contain':65C 'content':102C 'copi':99C 'craft':88C 'declar':91C 'decod':71C,104C 'disclosur':68C 'ffmpeg':62C 'frame':106C 'higher':96C 'indic':83C,98C 'inform':67C 'leak':76C 'libavcodec/mvcdec.c':74C 'memori':79C 'mvc2':72C,89C 'palett':82C,97C 'process':100C 'referenc':95C 'rgb':105C 'stack':78C,101C 'stream':90C 'suppli':86C 'uncheck':81C 'uniniti':77C 'vulner':69C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T19:16:54+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125190","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125190","severity":null,"published_at":"2026-11-09T19:16:54+00:00","modified_at":"2026-11-09T19:16:54+00:00","first_seen_at":"2026-11-09T19:28:17+00:00","fetched_at":"2026-11-09T19:28:17+00:00","note":null}],"documents":[{"id":109271,"url":"https://github.com/FFmpeg/FFmpeg/commit/3a5eb948e76dc6390e4b3cff7becf84bc492b7af","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109272,"url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-uninitialized-stack-memory-disclosure-via-mvc2-decoder","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}