CVE-2026-125096: FFmpeg through 9.0.2 Uninitialized Memory Disclosure via Tiertex SEQ Decoder

Q: Who is exposed to this issue?

Systems that use affected FFmpeg versions to decode attacker-supplied Tiertex SEQ files are exposed. The attacker needs to induce decoding of a crafted file; the vulnerability can disclose stack contents in the resulting visible decoded output.

Q: Does exploitation require authentication or user interaction?

The supplied CVSS vector indicates no privileges are required, but user interaction is required. Exploitation is local according to the attack vector and depends on a crafted Tiertex SEQ file being decoded.

Q: How can I determine whether my deployment is affected?

Check whether the FFmpeg version in use is 9.0.2 or earlier and whether it decodes Tiertex SEQ content. The affected code is in libavcodec/tiertexseqv.c, specifically the seq_decode_op1() decoding path.

Q: What can be done if updating is not immediately possible?

Avoid decoding untrusted Tiertex SEQ files until an update can be applied. Where feasible, prevent Tiertex SEQ inputs from reaching the affected FFmpeg decoder.

Published Nov 9, 2026

Updated

FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in libavcodec/tiertexseqv.c that allows attackers to leak stack contents by triggering failed RLE unpacking. Attackers can supply a crafted Tiertex SEQ file so seqdecodeop1() copies an uninitialized 64-byte stack block into decoded frames, exposing stack memory in visible output.

Affected Software

1 affected component

FFmpeg FFmpeg<=9.0.2

Event History

Nov 9, 2026

CVE Published

via MITRE·07:10 PM

Data Sourced

via MITRE·07:10 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Systems that use affected FFmpeg versions to decode attacker-supplied Tiertex SEQ files are exposed. The attacker needs to induce decoding of a crafted file; the vulnerability can disclose stack contents in the resulting visible decoded output.

Does exploitation require authentication or user interaction?

The supplied CVSS vector indicates no privileges are required, but user interaction is required. Exploitation is local according to the attack vector and depends on a crafted Tiertex SEQ file being decoded.

How can I determine whether my deployment is affected?

Check whether the FFmpeg version in use is 9.0.2 or earlier and whether it decodes Tiertex SEQ content. The affected code is in libavcodec/tiertexseqv.c, specifically the seq_decode_op1() decoding path.

What can be done if updating is not immediately possible?

Avoid decoding untrusted Tiertex SEQ files until an update can be applied. Where feasible, prevent Tiertex SEQ inputs from reaching the affected FFmpeg decoder.

CVE-2026-125096: FFmpeg through 9.0.2 Uninitialized Memory Disclosure via Tiertex SEQ Decoder

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this issue?

Does exploitation require authentication or user interaction?

How can I determine whether my deployment is affected?

What can be done if updating is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

Does exploitation require authentication or user interaction?

How can I determine whether my deployment is affected?

What can be done if updating is not immediately possible?