CVE-2026-125098: FFmpeg through 9.0.2 WebP Decoder Information Disclosure via Short ALPH Chunk

Q: Which deployments are exposed?

Deployments using FFmpeg through 9.0.2 that decode WebP images are affected. Exposure is most relevant where the decoder processes attacker-supplied or otherwise untrusted WebP content.

Q: What must occur for exploitation?

An attacker must supply a crafted WebP image containing an uncompressed ALPH chunk shorter than the image width multiplied by its height. The CVSS vector indicates user interaction is required.

Q: What information could be exposed?

The decoder can leave portions of the alpha plane uninitialized, allowing disclosure of stale pixel data from frames decoded previously in the same process.

Q: How can teams assess whether they may be affected?

Identify FFmpeg installations at or below version 9.0.2, then determine whether they decode WebP files. Review whether those decoding paths can receive untrusted images and whether multiple frames may be decoded in the same process.

Published Nov 9, 2026

Updated

FFmpeg through 9.0.2 contains an information disclosure vulnerability in vp8lossydecodealpha() in libavcodec/webp.c that leaves alpha plane memory uninitialized for short uncompressed ALPH chunks. Attackers can supply a crafted WebP image whose ALPH chunk is shorter than width height to disclose stale pixel data from previously decoded frames.

Affected Software

1 affected component

FFmpeg FFmpeg<=9.0.2

Event History

Nov 9, 2026

CVE Published

via MITRE·07:10 PM

Data Sourced

via MITRE·07:10 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:16 PM

DescriptionSeverityWeakness

Event

via NVD·07:16 PM

Frequently Asked Questions

Which deployments are exposed?

Deployments using FFmpeg through 9.0.2 that decode WebP images are affected. Exposure is most relevant where the decoder processes attacker-supplied or otherwise untrusted WebP content.

What must occur for exploitation?

An attacker must supply a crafted WebP image containing an uncompressed ALPH chunk shorter than the image width multiplied by its height. The CVSS vector indicates user interaction is required.

What information could be exposed?

The decoder can leave portions of the alpha plane uninitialized, allowing disclosure of stale pixel data from frames decoded previously in the same process.

How can teams assess whether they may be affected?

Identify FFmpeg installations at or below version 9.0.2, then determine whether they decode WebP files. Review whether those decoding paths can receive untrusted images and whether multiple frames may be decoded in the same process.

CVE-2026-125098: FFmpeg through 9.0.2 WebP Decoder Information Disclosure via Short ALPH Chunk

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed?

What must occur for exploitation?

What information could be exposed?

How can teams assess whether they may be affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What must occur for exploitation?

What information could be exposed?

How can teams assess whether they may be affected?