CVE-2026-125195 · Package
NO FIX YET
FFmpeg through 9.0.2 has an uninitialized memory bug in the ADPCM encoder that leaks heap bytes when encoding mono ADPCM_MS audio with trellis enabled. An attacker who submits audio to a service that encodes this way can read stale heap memory from the encoded output.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Only services that run FFmpeg's ADPCM_MS encoder with trellis enabled on audio that users can submit and receive back. Sources do not say whether default settings trigger it. Systems that only decode audio or never encode ADPCM_MS are likely unaffected.
Not affected if no-adpcm-ms-encoding, no-user-submitted-audio
Who cares audio-transcoding, ffmpeg, libavcodec
ffmpeg -version; versions through 9.0.2 are described as affected.-c:a adpcm_ms and trellis enabled, such as user-uploaded audio transcoding pipelines.No fix yet, per the sources.
FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in adpcm_encode_frame() in libavcodec/adpcmenc.c that leaks heap bytes when encoding mono ADPCM_MS audio with trellis enabled. Attackers submitting audio to a service using this encoding receive output packets where about half of each block contains stale heap memory from the encoding process.
This page as .md · .json · CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.