{"id":"CVE-2026-125193","kind":"vulnerability","aliases":["CVE-2026-125193"],"related":[],"title":"FFmpeg: truncated UYVY422 packets cause out-of-bounds heap read","description":"FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in bitpacked_decode_uyvy422() in libavcodec/bitpacked_dec.c because it never verifies packets hold width * height * 2 bytes. Attackers can supply truncated bitpacked UYVY422 packets via crafted SDP/RFC 4175 RTP sessions or raw input to crash applications or expose adjacent heap memory.","summary":"FFmpeg through 9.0.2 does not check that bitpacked UYVY422 packets hold width × height × 2 bytes, so bitpacked_decode_uyvy422() reads past the buffer. An attacker who supplies a crafted RTP or raw stream can crash the application or expose adjacent heap memory.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ffmpeg","media-processing","package","rtp","self-hosted"],"not_affected_if":["no-untrusted-input","rtp-not-used"],"how_to_check":"- Check the installed FFmpeg version with `ffmpeg -version`, and compare it against the fixed release listed in the sources.\n- Look for applications that decode RFC 4175 RTP (SDP) streams or raw bitpacked UYVY422 input from untrusted sources.","fix":"- FFmpeg: move to a release newer than `9.0.2`; the sources link a patch but do not name the fixed version.","status":"open","published_at":"2026-11-09T19:16:55+00:00","first_seen_at":"2026-11-09T19:28:17+00:00","triaged_at":"2026-11-09T19:30:19+00:00","updated_at":"2026-11-09T19:30:19+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-09T19:30:19Z","model":"claude-haiku-5-5","output":{"fix":"- FFmpeg: move to a release newer than `9.0.2`; the sources link a patch but do not name the fixed version.","reach":"network","title":"FFmpeg: truncated UYVY422 packets cause out-of-bounds heap read","impact":"medium","summary":"FFmpeg through 9.0.2 does not check that bitpacked UYVY422 packets hold width × height × 2 bytes, so bitpacked_decode_uyvy422() reads past the buffer. An attacker who supplies a crafted RTP or raw stream can crash the application or expose adjacent heap memory.","audience":"businesses","category":"package","nicknames":[],"who_cares":["ffmpeg","media-processing","rtp","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Application crashes or adjacent heap memory is exposed to the attacker.","analyst_note":"Confirm the fixed FFmpeg version from the linked patch at github.com and the NVD entry; the sources do not name it.","how_to_check":"- Check the installed FFmpeg version with `ffmpeg -version`, and compare it against the fixed release listed in the sources.\n- Look for applications that decode RFC 4175 RTP (SDP) streams or raw bitpacked UYVY422 input from untrusted sources.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-untrusted-input","rtp-not-used"],"who_is_affected":"Exposure requires FFmpeg's libavcodec bitpacked decoder to handle attacker-controlled data, such as RFC 4175 RTP sessions from SDP or raw UYVY422 input. Services that only transcode trusted local files are less exposed. unknown whether the sources list affected builds beyond 'through 9.0.2'.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000797,"input_tokens":4647,"output_tokens":664,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125193':14A,17A '-2026':13A,16A '2':40B,94C '4175':106C '9.0.2':29B,71C 'adjac':66B,117C 'applic':63B,114C 'attack':51B,96C 'bitpack':34B,43B,81C,100C 'bound':9A,77C 'buffer':49B 'byte':41B,95C 'caus':5A 'check':32B 'contain':72C 'craft':55B,104C 'crash':61B,113C 'cve':12A,15A 'decod':44B,82C 'expos':65B,116C 'ffmpeg':1A,18B,27B,69C 'heap':10A,67B,118C 'height':39B,93C 'hold':37B,91C 'host':26B 'input':111C 'libavcodec/bitpacked_dec.c':85C 'media':20B 'media-process':19B 'memori':68B,119C 'never':88C 'out-of-bound':6A,74C 'packag':22B 'packet':4A,36B,90C,102C 'past':47B 'process':21B 'raw':58B,110C 'read':11A,46B,78C 'rtp':23B,56B,107C 'sdp/rfc':105C 'self':25B 'self-host':24B 'session':108C 'stream':59B 'suppli':53B,98C 'truncat':2A,99C 'uyvy422':3A,35B,45B,83C,101C 'verifi':89C 'via':103C 'vulner':79C 'width':38B,92C","nicknames":[],"mitigations":[],"who_affected":"Exposure requires FFmpeg's libavcodec bitpacked decoder to handle attacker-controlled data, such as RFC 4175 RTP sessions from SDP or raw UYVY422 input. Services that only transcode trusted local files are less exposed. unknown whether the sources list affected builds beyond 'through 9.0.2'.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ffmpeg","mediaprocessing","medium","package","rtp","selfhosted"],"campaign_type":null,"search_a":"'-125193':14A,17A '-2026':13A,16A 'bound':9A 'caus':5A 'cve':12A,15A 'ffmpeg':1A 'heap':10A 'out-of-bound':6A 'packet':4A 'read':11A 'truncat':2A 'uyvy422':3A","search_b":"'2':40B '9.0.2':29B 'adjac':66B 'applic':63B 'attack':51B 'bitpack':34B,43B 'buffer':49B 'byte':41B 'check':32B 'craft':55B 'crash':61B 'decod':44B 'expos':65B 'ffmpeg':18B,27B 'heap':67B 'height':39B 'hold':37B 'host':26B 'media':20B 'media-process':19B 'memori':68B 'packag':22B 'packet':36B 'past':47B 'process':21B 'raw':58B 'read':46B 'rtp':23B,56B 'self':25B 'self-host':24B 'stream':59B 'suppli':53B 'uyvy422':35B,45B 'width':38B","search_c":"'2':94C '4175':106C '9.0.2':71C 'adjac':117C 'applic':114C 'attack':96C 'bitpack':81C,100C 'bound':77C 'byte':95C 'contain':72C 'craft':104C 'crash':113C 'decod':82C 'expos':116C 'ffmpeg':69C 'heap':118C 'height':93C 'hold':91C 'input':111C 'libavcodec/bitpacked_dec.c':85C 'memori':119C 'never':88C 'out-of-bound':74C 'packet':90C,102C 'raw':110C 'read':78C 'rtp':107C 'sdp/rfc':105C 'session':108C 'suppli':98C 'truncat':99C 'uyvy422':83C,101C 'verifi':89C 'via':103C 'vulner':79C 'width':92C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T19:16:55+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125193","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125193","severity":null,"published_at":"2026-11-09T19:16:55+00:00","modified_at":"2026-11-09T19:16:55+00:00","first_seen_at":"2026-11-09T19:28:17+00:00","fetched_at":"2026-11-09T19:28:17+00:00","note":null}],"documents":[{"id":109277,"url":"https://github.com/FFmpeg/FFmpeg/commit/f1205ee01893a3b509d96b5fe3aeda755c517973","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109278,"url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-out-of-bounds-read-via-bitpacked-decode-uyvy422","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}