CVE-2026-125192 · Package
NO FIX YET
FFmpeg's DXA video decoder in libavcodec copies an uninitialized buffer into output frames when it reads a crafted DXA file with a type 4 frame. An attacker who supplies such a file can read leftover heap contents in the decoded pictures.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Systems that decode DXA files from untrusted sources with FFmpeg's libavcodec, such as media processing services or upload pipelines that transcode user files. Applications that never decode DXA input are unlikely to be reached. The sources do not name the fixed version beyond a patch link.
Not affected if dxa-not-decoded, no-untrusted-media
Who cares ffmpeg, libavcodec, media-processing
ffmpeg -version and compare against the fixed release named in the sources.No fix yet, per the sources.
FFmpeg through 9.0.2 contains an uninitialized memory vulnerability in the DXA decoder in libavcodec/dxa.c that allows attackers to disclose heap memory via crafted DXA files. Attackers can supply a DXA video with a type 4 frame that copies the uninitialized decomp_buf buffer into output pictures, exposing leftover heap contents in decoded frames.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.