CVE-2026-125171: FFmpeg through 9.0.2 Out-of-Bounds Read in Musepack SV7 Decoder via mpc7.c

Q: What must an attacker provide to trigger the issue?

An attacker must cause FFmpeg to process a crafted Musepack SV7 file whose final frame declares an oversized length. The vulnerable initialization path fails to validate that final-frame length against MPC_FRAME_SIZE.

Q: What impact should operators expect from successful exploitation?

Processing the crafted file can make consumers of decoded frames read past the audio buffer. The reported consequences are crashes and possible disclosure of heap memory.

Q: Is user interaction required?

The supplied vector identifies the issue as local and requiring user interaction. In practice, a user or application workflow must provide or open the crafted Musepack SV7 file for FFmpeg to process it.

Published Nov 9, 2026

Updated

FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in the Musepack SV7 decoder because mpc7decodeinit() does not validate lastframelen against MPCFRAMESIZE. Attackers can supply a crafted Musepack SV7 file declaring an oversized final frame, causing consumers of decoded frames to read past the audio buffer, leading to crashes or heap memory disclosure.

Affected Software

1 affected component

FFmpeg FFmpeg<=9.0.2

Event History

Nov 9, 2026

CVE Published

via MITRE·07:10 PM

Data Sourced

via MITRE·07:10 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What must an attacker provide to trigger the issue?

An attacker must cause FFmpeg to process a crafted Musepack SV7 file whose final frame declares an oversized length. The vulnerable initialization path fails to validate that final-frame length against MPC_FRAME_SIZE.

What impact should operators expect from successful exploitation?

Processing the crafted file can make consumers of decoded frames read past the audio buffer. The reported consequences are crashes and possible disclosure of heap memory.

Is user interaction required?

The supplied vector identifies the issue as local and requiring user interaction. In practice, a user or application workflow must provide or open the crafted Musepack SV7 file for FFmpeg to process it.

CVE-2026-125171: FFmpeg through 9.0.2 Out-of-Bounds Read in Musepack SV7 Decoder via mpc7.c

Affected Software

Event History

Frequently Asked Questions

What must an attacker provide to trigger the issue?

What impact should operators expect from successful exploitation?

Is user interaction required?

Company

Resources

Contact

Frequently Asked Questions

What must an attacker provide to trigger the issue?

What impact should operators expect from successful exploitation?

Is user interaction required?