CVE-2026-125268 · Package
NO FIX YET · SEE WHAT TO DO
FFmpeg's CineForm HD decoder in libavcodec/cfhd.c leaves a temporary buffer unzeroed, so a crafted CFHD file with an ImageHeight tag larger than the coded band heights gets uninitialized heap bytes filtered into decoded video. An attacker can read leftover heap memory from the decoded output.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications that run FFmpeg's decoder on untrusted CineForm HD (CFHD) media files are exposed, since a crafted file can leak heap memory into decoded output. Systems that only process trusted media or do not decode CFHD can likely skip it. The sources do not describe a specific default configuration.
Not affected if cfhd-not-used, no-untrusted-media
Who cares ffmpeg, libavcodec, media-processing
ffmpeg -version; the sources say versions through 9.0.2 are affectedcfhd decoder in ffmpeg -decodersFFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in the CineForm HD decoder that allows attackers to leak heap memory via unzeroed idwt_tmp buffers in libavcodec/cfhd.c. Attackers can supply a crafted CFHD file with an ImageHeight tag exceeding coded band heights, causing uninitialized heap bytes to be filtered into decoded video output.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.