---
id: "CVE-2026-125268"
page: "https://infrastack.ai/live/CVE-2026-125268"
kind: "vulnerability"
aliases: ["CVE-2026-125268"]
title: "FFmpeg: crafted CineForm file leaks uninitialized heap memory into video output"
severity: "medium"
cvss: 4.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["ffmpeg", "libavcodec", "media-processing", "package"]
not_affected_if: ["cfhd-not-used", "no-untrusted-media"]
published_at: "2026-11-09T20:18:13+00:00"
first_seen_at: "2026-11-09T20:48:14+00:00"
updated_at: "2026-11-09T20:50:01+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-125268", "first_seen_at": "2026-11-09T20:48:14+00:00"}]
exploit_sources: []
---

# FFmpeg: crafted CineForm file leaks uninitialized heap memory into video output

Link for people: https://infrastack.ai/live/CVE-2026-125268 (this .md is for agents)

FFmpeg's CineForm HD decoder in libavcodec/cfhd.c leaves a temporary buffer unzeroed, so a crafted CFHD file with an ImageHeight tag larger than the coded band heights gets uninitialized heap bytes filtered into decoded video. An attacker can read leftover heap memory from the decoded output.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the FFmpeg version with `ffmpeg -version`; the sources say versions through 9.0.2 are affected
- Check whether the CineForm HD (CFHD) decoder is in use by looking for the `cfhd` decoder in `ffmpeg -decoders`

## Fix

- FFmpeg: the sources reference a patch on github.com but do not state a fixed version number

## Timeline

- 2026-11-09T20:48:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-125268

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-uninitialized-heap-memory-disclosure-in-cfhd-decoder
- [fix] Patch: github.com https://github.com/FFmpeg/FFmpeg/commit/0bfa350291b2118f6d590263dc1ee9cea766c0f1

## From the sources

FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in the CineForm HD decoder that allows attackers to leak heap memory via unzeroed idwt_tmp buffers in libavcodec/cfhd.c. Attackers can supply a crafted CFHD file with an ImageHeight tag exceeding coded band heights, causing uninitialized heap bytes to be filtered into decoded video output.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_