CVE-2026-125097: FFmpeg through 9.0.2 Uninitialized Heap Memory Disclosure via rawdec.c Raw Video Decoder

Q: Who is exposed to this issue?

Any FFmpeg use that decodes untrusted AVI, MOV, or NUT files containing low-bit-depth rawvideo is exposed. The affected decoder path applies to rawvideo formats using 1 to 8 bits per pixel.

Q: What must an attacker do to exploit it?

An attacker must provide a crafted media file with a truncated low-bit-depth rawvideo packet whose stride does not cover a complete row, and cause FFmpeg to decode it. The attack requires user interaction according to the supplied vector.

Q: What information could be disclosed?

Decoded frame output can contain uninitialized heap memory. The provided impact rating identifies confidentiality impact as low, with no integrity or availability impact.

Q: How can I determine whether an environment is affected?

Check whether the deployed FFmpeg version is through 9.0.2 and whether it decodes AVI, MOV, or NUT content from untrusted sources. Review uses of the raw video decoder for 1 to 8 bits per pixel input.

Published Nov 9, 2026

Updated

FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in rawdecode() in libavcodec/rawdec.c that fails to verify packet stride covers a full row for 1 to 8 bits per pixel video. Attackers can supply crafted AVI, MOV or NUT files with truncated low bit depth rawvideo packets to leak uninitialized heap memory through decoded frame output.

Affected Software

1 affected component

FFmpeg FFmpeg<=9.0.2

Event History

Nov 9, 2026

CVE Published

via MITRE·07:10 PM

Data Sourced

via MITRE·07:10 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Any FFmpeg use that decodes untrusted AVI, MOV, or NUT files containing low-bit-depth rawvideo is exposed. The affected decoder path applies to rawvideo formats using 1 to 8 bits per pixel.

What must an attacker do to exploit it?

An attacker must provide a crafted media file with a truncated low-bit-depth rawvideo packet whose stride does not cover a complete row, and cause FFmpeg to decode it. The attack requires user interaction according to the supplied vector.

What information could be disclosed?

Decoded frame output can contain uninitialized heap memory. The provided impact rating identifies confidentiality impact as low, with no integrity or availability impact.

How can I determine whether an environment is affected?

Check whether the deployed FFmpeg version is through 9.0.2 and whether it decodes AVI, MOV, or NUT content from untrusted sources. Review uses of the raw video decoder for 1 to 8 bits per pixel input.

CVE-2026-125097: FFmpeg through 9.0.2 Uninitialized Heap Memory Disclosure via rawdec.c Raw Video Decoder

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this issue?

What must an attacker do to exploit it?

What information could be disclosed?

How can I determine whether an environment is affected?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What must an attacker do to exploit it?

What information could be disclosed?

How can I determine whether an environment is affected?