{"id":"CVE-2026-125192","kind":"vulnerability","aliases":["CVE-2026-125192"],"related":[],"title":"FFmpeg: DXA decoder leaks heap memory through crafted video files","description":"FFmpeg through 9.0.2 contains an uninitialized memory vulnerability in the DXA decoder in libavcodec/dxa.c that allows attackers to disclose heap memory via crafted DXA files. Attackers can supply a DXA video with a type 4 frame that copies the uninitialized decomp_buf buffer into output pictures, exposing leftover heap contents in decoded frames.","summary":"FFmpeg's DXA video decoder in libavcodec copies an uninitialized buffer into output frames when it reads a crafted DXA file with a type 4 frame. An attacker who supplies such a file can read leftover heap contents in the decoded pictures.","severity":"medium","cvss":4.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ffmpeg","libavcodec","media-processing","package"],"not_affected_if":["dxa-not-decoded","no-untrusted-media"],"how_to_check":"- Run `ffmpeg -version` and compare against the fixed release named in the sources.\n- Check whether the DXA decoder is in use: unknown whether the sources give a specific command for this.","fix":null,"status":"open","published_at":"2026-11-09T19:16:55+00:00","first_seen_at":"2026-11-09T19:28:17+00:00","triaged_at":"2026-11-09T19:32:17+00:00","updated_at":"2026-11-09T19:32:17+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-09T19:32:17Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"FFmpeg: DXA decoder leaks heap memory through crafted video files","impact":"low","summary":"FFmpeg's DXA video decoder in libavcodec copies an uninitialized buffer into output frames when it reads a crafted DXA file with a type 4 frame. An attacker who supplies such a file can read leftover heap contents in the decoded pictures.","audience":"businesses","category":"package","nicknames":[],"who_cares":["ffmpeg","libavcodec","media-processing"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"heap memory contents leak into decoded video frames","analyst_note":"Confirm the first fixed FFmpeg version and the patch commit from the linked GitHub patch and the VulnCheck advisory; the sources here do not state a fixed version.","how_to_check":"- Run `ffmpeg -version` and compare against the fixed release named in the sources.\n- Check whether the DXA decoder is in use: unknown whether the sources give a specific command for this.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-untrusted-media","dxa-not-decoded"],"who_is_affected":"Systems that decode DXA files from untrusted sources with FFmpeg's libavcodec, such as media processing services or upload pipelines that transcode user files. Applications that never decode DXA input are unlikely to be reached. The sources do not name the fixed version beyond a patch link.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000744,"input_tokens":4634,"output_tokens":561,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125192':13A,16A '-2026':12A,15A '4':47B,99C '9.0.2':67C 'allow':80C 'attack':50B,81C,90C 'buf':106C 'buffer':33B,107C 'contain':68C 'content':60B,114C 'copi':30B,102C 'craft':8A,41B,87C 'cve':11A,14A 'decod':3A,27B,63B,76C,116C 'decomp':105C 'disclos':83C 'dxa':2A,25B,42B,75C,88C,94C 'expos':111C 'ffmpeg':1A,17B,23B,65C 'file':10A,43B,55B,89C 'frame':36B,48B,100C,117C 'heap':5A,59B,84C,113C 'leak':4A 'leftov':58B,112C 'libavcodec':18B,29B 'libavcodec/dxa.c':78C 'media':20B 'media-process':19B 'memori':6A,71C,85C 'output':35B,109C 'packag':22B 'pictur':64B,110C 'process':21B 'read':39B,57B 'suppli':52B,92C 'type':46B,98C 'uniniti':32B,70C,104C 'via':86C 'video':9A,26B,95C 'vulner':72C","nicknames":[],"mitigations":[],"who_affected":"Systems that decode DXA files from untrusted sources with FFmpeg's libavcodec, such as media processing services or upload pipelines that transcode user files. Applications that never decode DXA input are unlikely to be reached. The sources do not name the fixed version beyond a patch link.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ffmpeg","libavcodec","mediaprocessing","medium","package"],"campaign_type":null,"search_a":"'-125192':13A,16A '-2026':12A,15A 'craft':8A 'cve':11A,14A 'decod':3A 'dxa':2A 'ffmpeg':1A 'file':10A 'heap':5A 'leak':4A 'memori':6A 'video':9A","search_b":"'4':47B 'attack':50B 'buffer':33B 'content':60B 'copi':30B 'craft':41B 'decod':27B,63B 'dxa':25B,42B 'ffmpeg':17B,23B 'file':43B,55B 'frame':36B,48B 'heap':59B 'leftov':58B 'libavcodec':18B,29B 'media':20B 'media-process':19B 'output':35B 'packag':22B 'pictur':64B 'process':21B 'read':39B,57B 'suppli':52B 'type':46B 'uniniti':32B 'video':26B","search_c":"'4':99C '9.0.2':67C 'allow':80C 'attack':81C,90C 'buf':106C 'buffer':107C 'contain':68C 'content':114C 'copi':102C 'craft':87C 'decod':76C,116C 'decomp':105C 'disclos':83C 'dxa':75C,88C,94C 'expos':111C 'ffmpeg':65C 'file':89C 'frame':100C,117C 'heap':84C,113C 'leftov':112C 'libavcodec/dxa.c':78C 'memori':71C,85C 'output':109C 'pictur':110C 'suppli':92C 'type':98C 'uniniti':70C,104C 'via':86C 'video':95C 'vulner':72C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T19:16:55+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125192","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125192","severity":null,"published_at":"2026-11-09T19:16:55+00:00","modified_at":"2026-11-09T19:16:55+00:00","first_seen_at":"2026-11-09T19:28:17+00:00","fetched_at":"2026-11-09T19:28:17+00:00","note":null}],"documents":[{"id":109275,"url":"https://github.com/FFmpeg/FFmpeg/commit/a6e5d5ff993a525933d8d8f29071eb6c74b0436a","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109276,"url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-heap-memory-disclosure-via-dxa-decoder-uninitialized-buffer","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}