CVE-2026-125101: FFmpeg through 9.0.2 VMnc Decoder Uninitialized Heap Memory Disclosure

Q: Who is exposed to this issue?

Applications that use FFmpeg to decode attacker-controlled VMnc streams are exposed. Exploitation requires a user or application to process a crafted stream, so it is most relevant to workflows that accept untrusted VMnc media or remote-display content.

Q: What must an attacker do to trigger the disclosure?

The attacker must provide a crafted VMnc stream containing a frame that fails after the decoder has loaded a cursor shape. This causes the decoder to restore an unwritten cursor save area, making uninitialized heap bytes from screendta visible in decoded output.

Q: Is this limited to a particular FFmpeg release?

The affected range is described as FFmpeg through version 9.0.2. The supplied references include a source location in the n9.0.2 tree and a commit that addresses the issue.

Published Nov 9, 2026

Updated

FFmpeg through 9.0.2 contains an information disclosure vulnerability in the VMnc decoder in libavcodec/vmnc.c that restores an unwritten cursor save area into later frames. Attackers can supply a crafted VMnc stream where a frame fails after loading a cursor shape, causing uninitialized heap bytes from screendta to appear in decoded output.

Affected Software

1 affected component

FFmpeg FFmpeg<=9.0.2

Event History

Nov 9, 2026

CVE Published

via MITRE·07:10 PM

Data Sourced

via MITRE·07:10 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Applications that use FFmpeg to decode attacker-controlled VMnc streams are exposed. Exploitation requires a user or application to process a crafted stream, so it is most relevant to workflows that accept untrusted VMnc media or remote-display content.

What must an attacker do to trigger the disclosure?

The attacker must provide a crafted VMnc stream containing a frame that fails after the decoder has loaded a cursor shape. This causes the decoder to restore an unwritten cursor save area, making uninitialized heap bytes from screendta visible in decoded output.

Is this limited to a particular FFmpeg release?

The affected range is described as FFmpeg through version 9.0.2. The supplied references include a source location in the n9.0.2 tree and a commit that addresses the issue.

CVE-2026-125101: FFmpeg through 9.0.2 VMnc Decoder Uninitialized Heap Memory Disclosure

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this issue?

What must an attacker do to trigger the disclosure?

Is this limited to a particular FFmpeg release?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What must an attacker do to trigger the disclosure?

Is this limited to a particular FFmpeg release?