CVE-2026-125193 · Package
NO FIX YET · SEE WHAT TO DO
FFmpeg through 9.0.2 does not check that bitpacked UYVY422 packets hold width × height × 2 bytes, so bitpacked_decode_uyvy422() reads past the buffer. An attacker who supplies a crafted RTP or raw stream can crash the application or expose adjacent heap memory.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Exposure requires FFmpeg's libavcodec bitpacked decoder to handle attacker-controlled data, such as RFC 4175 RTP sessions from SDP or raw UYVY422 input. Services that only transcode trusted local files are less exposed. unknown whether the sources list affected builds beyond 'through 9.0.2'.
Not affected if no-untrusted-input, rtp-not-used
Who cares ffmpeg, media-processing, rtp, self-hosted
ffmpeg -version, and compare it against the fixed release listed in the sources.9.0.2; the sources link a patch but do not name the fixed version.FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in bitpacked_decode_uyvy422() in libavcodec/bitpacked_dec.c because it never verifies packets hold width * height * 2 bytes. Attackers can supply truncated bitpacked UYVY422 packets via crafted SDP/RFC 4175 RTP sessions or raw input to crash applications or expose adjacent heap memory.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.