CVE-2026-125266 · Package
NO FIX YET
FFmpeg through 9.0.2 has an uninitialized stack memory read in the old_codec23() decoder in libavcodec/sanm.c. A crafted LucasArts SMUSH/SANM file using codec 23 can leak stack bytes into decoded output video.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Systems that decode untrusted SANM/SMUSH animation files with FFmpeg, such as media-processing services that accept user uploads. Installations that never decode these files are unlikely to be exposed. The sources do not state a fixed version beyond a patch link.
Not affected if no-untrusted-media, sanm-not-decoded
Who cares ffmpeg, libavcodec, media-processing
Unknown from the sources.
No fix yet, per the sources.
FFmpeg through 9.0.2 contains an uninitialized stack memory disclosure vulnerability in old_codec23() of libavcodec/sanm.c that leaks stack bytes into decoded frames. Attackers can supply a crafted LucasArts SMUSH/SANM animation using codec 23 with an inline table to expose decoder process stack memory in output video.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.