FFMPEG · CVE-2026-125217 · Package
NO FIX YET
FFmpeg's RoQ DPCM audio encoder reads uninitialized heap memory when a short stream is flushed early, so stale heap contents get written into output packets. An attacker who supplies a short audio stream under eight frames can leak that heap data into transcoded output.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams that run FFmpeg to transcode audio, especially pipelines that accept user-supplied audio and encode it to RoQ DPCM. The sources describe a leak of stale heap data into output, not code execution. Systems that do not run RoQ DPCM encoding on untrusted input are unlikely to be exposed.
Not affected if no-roq-encoding, trusted-input-only
Who cares ffmpeg, media-processing, transcoding
ffmpeg -version; the sources say the flaw covers releases through 9.0.2.-c:a roq_dpcm) in pipelines that transcode untrusted audio.No fix yet, per the sources.
FFmpeg through 9.0.2 contains an uninitialized memory use vulnerability in roq_dpcm_encode_frame() in libavcodec/roqaudioenc.c that encodes stale heap contents when flushed early. Attackers can supply short audio streams under eight frames for RoQ DPCM transcoding, causing DPCM-quantized uninitialized heap data from frame_buffer to leak into output packets.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.