CVE-2026-125170: FFmpeg through 9.0.2 Uninitialized Memory Disclosure via targa_decode_rle()

Q: What must an attacker do to trigger the disclosure?

An attacker must cause FFmpeg to decode a truncated RLE-compressed TGA image. The supplied image can lead decoded frames to include leftover heap-buffer contents and replicated uninitialized stack bytes.

Q: Is remote exploitation possible without user interaction?

The vector is local and user interaction is required. The provided information indicates the attacker needs a user or process to open or otherwise decode the crafted TGA image with FFmpeg.

Q: What information could be exposed?

Decoded frames may disclose uninitialized memory, specifically leftover heap buffer data and replicated uninitialized stack bytes. The stated impact is confidentiality loss only; no integrity or availability impact is specified.

Published Nov 9, 2026

Updated

FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in targadecoderle() in libavcodec/targa.c caused by missing packet length checks. Attackers can supply truncated RLE-compressed TGA images so decoded frames contain leftover heap buffer data and replicated uninitialized stack bytes.

Affected Software

1 affected component

FFmpeg FFmpeg<=9.0.2

Event History

Nov 9, 2026

CVE Published

via MITRE·07:10 PM

Data Sourced

via MITRE·07:10 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What must an attacker do to trigger the disclosure?

An attacker must cause FFmpeg to decode a truncated RLE-compressed TGA image. The supplied image can lead decoded frames to include leftover heap-buffer contents and replicated uninitialized stack bytes.

Is remote exploitation possible without user interaction?

The vector is local and user interaction is required. The provided information indicates the attacker needs a user or process to open or otherwise decode the crafted TGA image with FFmpeg.

What information could be exposed?

Decoded frames may disclose uninitialized memory, specifically leftover heap buffer data and replicated uninitialized stack bytes. The stated impact is confidentiality loss only; no integrity or availability impact is specified.

CVE-2026-125170: FFmpeg through 9.0.2 Uninitialized Memory Disclosure via targa_decode_rle()

Affected Software

Event History

Frequently Asked Questions

What must an attacker do to trigger the disclosure?

Is remote exploitation possible without user interaction?

What information could be exposed?

Company

Resources

Contact

Frequently Asked Questions

What must an attacker do to trigger the disclosure?

Is remote exploitation possible without user interaction?

What information could be exposed?