CVE-2026-125102: FFmpeg through 9.0.2 TAK Decoder Uninitialized Memory Disclosure via takdec.c

Q: Who is realistically exposed to this issue?

Applications that decode attacker-controlled multichannel TAK audio using affected FFmpeg versions are exposed. The attacker must be able to get a user or service to process a crafted TAK file.

Q: What does exploitation require?

Exploitation requires a crafted multichannel TAK file whose decorrelation list omits one or more channels. The affected decoder can then output uninitialized sample-buffer contents as decoded audio.

Q: Is user interaction required?

Yes. The supplied vector indicates user interaction is required, meaning the crafted file must be opened or otherwise processed by the affected application.

Q: How can I determine whether my deployment may be affected?

Check whether your application uses FFmpeg through version 9.0.2 and enables decoding of multichannel TAK files. Review whether it processes TAK content from untrusted sources.

Published Nov 9, 2026

Updated

FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in takdecodeframe() in libavcodec/takdec.c that fails to verify multichannel decorrelation lists cover every channel. Attackers can supply crafted multichannel TAK files omitting channels from the list, causing undecoded sample buffers to leak heap memory through decoded audio.

Affected Software

1 affected component

FFmpeg FFmpeg<=9.0.2

Event History

Nov 9, 2026

CVE Published

via MITRE·07:10 PM

Data Sourced

via MITRE·07:10 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is realistically exposed to this issue?

Applications that decode attacker-controlled multichannel TAK audio using affected FFmpeg versions are exposed. The attacker must be able to get a user or service to process a crafted TAK file.

What does exploitation require?

Exploitation requires a crafted multichannel TAK file whose decorrelation list omits one or more channels. The affected decoder can then output uninitialized sample-buffer contents as decoded audio.

Is user interaction required?

Yes. The supplied vector indicates user interaction is required, meaning the crafted file must be opened or otherwise processed by the affected application.

How can I determine whether my deployment may be affected?

Check whether your application uses FFmpeg through version 9.0.2 and enables decoding of multichannel TAK files. Review whether it processes TAK content from untrusted sources.

CVE-2026-125102: FFmpeg through 9.0.2 TAK Decoder Uninitialized Memory Disclosure via takdec.c

Affected Software

Event History

Frequently Asked Questions

Who is realistically exposed to this issue?

What does exploitation require?

Is user interaction required?

How can I determine whether my deployment may be affected?

Company

Resources

Contact

Frequently Asked Questions

Who is realistically exposed to this issue?

What does exploitation require?

Is user interaction required?

How can I determine whether my deployment may be affected?