CVE-2026-125095: FFmpeg through 9.0.2 C93 Decoder Uninitialized Stack Memory Disclosure
Published Nov 9, 2026
·Updated
FFmpeg through 9.0.2 contains an uninitialized memory use vulnerability in the C93 video decoder in libavcodec/c93.c, where decodeframe() never checks how many color table bytes were copied. Attackers can supply a crafted truncated Interplay C93 file so drawncolor() writes uninitialized stack bytes into decoded frames, disclosing stack memory contents.
Affected Software
1 affected component
FFmpeg FFmpeg<=9.0.2
Event History
Nov 9, 2026
CVE Published
via MITRE·07:10 PM
Data Sourced
via MITRE·07:10 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·07:16 PM
DescriptionSeverityWeakness