CVE-2026-125243 · Package
NO FIX YET
FFmpeg's JPEG-LS decoder mishandles 16-bit line-interleaved scans by decoding them as 8-bit samples. A crafted single-component JPEG-LS image makes decoded GRAY16 frames expose uninitialized heap memory.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Systems that run FFmpeg and decode untrusted JPEG-LS images, such as media ingestion or transcoding services, could leak heap contents into output frames. Installations that never decode JPEG-LS from untrusted sources have much less exposure.
Not affected if no-untrusted-jpegls-input
Who cares ffmpeg, libavcodec, media-processing
Unknown from the sources.
No fix yet, per the sources.
FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in ff_jpegls_decode_picture() in libavcodec/jpeglsdec.c, which decodes 16-bit line-interleaved JPEG-LS scans as 8-bit samples. Attackers can supply a crafted single-component JPEG-LS image with the ILV byte set to 1, causing decoded GRAY16 frames to expose leftover heap memory.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.