{"id":"CVE-2026-125268","kind":"vulnerability","aliases":["CVE-2026-125268"],"related":[],"title":"FFmpeg: crafted CineForm file leaks uninitialized heap memory into video output","description":"FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in the CineForm HD decoder that allows attackers to leak heap memory via unzeroed idwt_tmp buffers in libavcodec/cfhd.c. Attackers can supply a crafted CFHD file with an ImageHeight tag exceeding coded band heights, causing uninitialized heap bytes to be filtered into decoded video output.","summary":"FFmpeg's CineForm HD decoder in libavcodec/cfhd.c leaves a temporary buffer unzeroed, so a crafted CFHD file with an ImageHeight tag larger than the coded band heights gets uninitialized heap bytes filtered into decoded video. An attacker can read leftover heap memory from the decoded output.","severity":"medium","cvss":4.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ffmpeg","libavcodec","media-processing","package"],"not_affected_if":["cfhd-not-used","no-untrusted-media"],"how_to_check":"- Check the FFmpeg version with `ffmpeg -version`; the sources say versions through 9.0.2 are affected\n- Check whether the CineForm HD (CFHD) decoder is in use by looking for the `cfhd` decoder in `ffmpeg -decoders`","fix":"- FFmpeg: the sources reference a patch on github.com but do not state a fixed version number","status":"open","published_at":"2026-11-09T20:18:13+00:00","first_seen_at":"2026-11-09T20:48:14+00:00","triaged_at":"2026-11-09T20:50:01+00:00","updated_at":"2026-11-09T20:50:01+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-09T20:50:01Z","model":"claude-haiku-5-5","output":{"fix":"- FFmpeg: the sources reference a patch on github.com but do not state a fixed version number\n- unknown for a fixed release number","reach":"unknown","title":"FFmpeg: crafted CineForm file leaks uninitialized heap memory into video output","impact":"low","summary":"FFmpeg's CineForm HD decoder in libavcodec/cfhd.c leaves a temporary buffer unzeroed, so a crafted CFHD file with an ImageHeight tag larger than the coded band heights gets uninitialized heap bytes filtered into decoded video. An attacker can read leftover heap memory from the decoded output.","audience":"developers","category":"package","nicknames":[],"who_cares":["ffmpeg","libavcodec","media-processing"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"heap memory contents leak into decoded video output","analyst_note":"Confirm the fixed FFmpeg version and patch commit from the github.com fix link; the sources do not state a fixed version.","how_to_check":"- Check the FFmpeg version with `ffmpeg -version`; the sources say versions through 9.0.2 are affected\n- Check whether the CineForm HD (CFHD) decoder is in use by looking for the `cfhd` decoder in `ffmpeg -decoders`\n- unknown for whether a specific build includes the fix","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-untrusted-media","cfhd-not-used"],"who_is_affected":"Applications that run FFmpeg's decoder on untrusted CineForm HD (CFHD) media files are exposed, since a crafted file can leak heap memory into decoded output. Systems that only process trusted media or do not decode CFHD can likely skip it. The sources do not describe a specific default configuration.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000808,"input_tokens":4643,"output_tokens":687,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125268':14A,17A '-2026':13A,16A '9.0.2':72C 'allow':85C 'attack':60B,86C,98C 'band':49B,111C 'buffer':34B,95C 'byte':54B,116C 'caus':113C 'cfhd':39B,103C 'cineform':3A,26B,81C 'code':48B,110C 'contain':73C 'craft':2A,38B,102C 'cve':12A,15A 'decod':28B,57B,68B,83C,121C 'disclosur':77C 'exceed':109C 'ffmpeg':1A,18B,24B,70C 'file':4A,40B,104C 'filter':55B,119C 'get':51B 'hd':27B,82C 'heap':7A,53B,64B,89C,115C 'height':50B,112C 'idwt':93C 'imageheight':43B,107C 'larger':45B 'leak':5A,88C 'leav':31B 'leftov':63B 'libavcodec':19B 'libavcodec/cfhd.c':30B,97C 'media':21B 'media-process':20B 'memori':8A,65B,76C,90C 'output':11A,69B,123C 'packag':23B 'process':22B 'read':62B 'suppli':100C 'tag':44B,108C 'temporari':33B 'tmp':94C 'uniniti':6A,52B,75C,114C 'unzero':35B,92C 'via':91C 'video':10A,58B,122C 'vulner':78C","nicknames":[],"mitigations":[],"who_affected":"Applications that run FFmpeg's decoder on untrusted CineForm HD (CFHD) media files are exposed, since a crafted file can leak heap memory into decoded output. Systems that only process trusted media or do not decode CFHD can likely skip it. The sources do not describe a specific default configuration.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ffmpeg","libavcodec","mediaprocessing","medium","package"],"campaign_type":null,"search_a":"'-125268':14A,17A '-2026':13A,16A 'cineform':3A 'craft':2A 'cve':12A,15A 'ffmpeg':1A 'file':4A 'heap':7A 'leak':5A 'memori':8A 'output':11A 'uniniti':6A 'video':10A","search_b":"'attack':60B 'band':49B 'buffer':34B 'byte':54B 'cfhd':39B 'cineform':26B 'code':48B 'craft':38B 'decod':28B,57B,68B 'ffmpeg':18B,24B 'file':40B 'filter':55B 'get':51B 'hd':27B 'heap':53B,64B 'height':50B 'imageheight':43B 'larger':45B 'leav':31B 'leftov':63B 'libavcodec':19B 'libavcodec/cfhd.c':30B 'media':21B 'media-process':20B 'memori':65B 'output':69B 'packag':23B 'process':22B 'read':62B 'tag':44B 'temporari':33B 'uniniti':52B 'unzero':35B 'video':58B","search_c":"'9.0.2':72C 'allow':85C 'attack':86C,98C 'band':111C 'buffer':95C 'byte':116C 'caus':113C 'cfhd':103C 'cineform':81C 'code':110C 'contain':73C 'craft':102C 'decod':83C,121C 'disclosur':77C 'exceed':109C 'ffmpeg':70C 'file':104C 'filter':119C 'hd':82C 'heap':89C,115C 'height':112C 'idwt':93C 'imageheight':107C 'leak':88C 'libavcodec/cfhd.c':97C 'memori':76C,90C 'output':123C 'suppli':100C 'tag':108C 'tmp':94C 'uniniti':75C,114C 'unzero':92C 'via':91C 'video':122C 'vulner':78C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T20:18:13+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125268","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125268","severity":null,"published_at":"2026-11-09T20:18:13+00:00","modified_at":"2026-11-09T20:18:13+00:00","first_seen_at":"2026-11-09T20:48:14+00:00","fetched_at":"2026-11-09T20:48:14+00:00","note":null}],"documents":[{"id":109751,"url":"https://github.com/FFmpeg/FFmpeg/commit/0bfa350291b2118f6d590263dc1ee9cea766c0f1","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109752,"url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-uninitialized-heap-memory-disclosure-in-cfhd-decoder","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}