CVE-2026-125175: FFmpeg through 9.0.2 Information Disclosure via Flash Screen Video Decoder

Q: What input must be processed for exploitation to be possible?

The affected FFmpeg instance must decode a crafted FLV file containing an FSV1 stream. The stream's zlib block data must decompress to less output than expected.

Q: What information can be disclosed?

Uninitialized heap memory can be copied into decoded frames. An attacker may recover that memory from decoded output or from output that is subsequently re-encoded.

Q: How can I identify deployments that need review?

Review FFmpeg deployments through version 9.0.2 that process FLV files, particularly where untrusted files may contain FSV1 streams. Focus on workflows that expose decoded frames or produce re-encoded media output.

Published Nov 9, 2026

Updated

FFmpeg through 9.0.2 contains an information disclosure vulnerability in flashsvdecodeblock() in libavcodec/flashsv.c that copies uninitialized heap memory into decoded frames when inflate output is short. Attackers can supply a crafted FLV with an FSV1 stream whose zlib block data decompresses short, then recover heap contents from the decoded or re-encoded output.

Affected Software

1 affected component

FFmpeg FFmpeg<=9.0.2

Event History

Nov 9, 2026

CVE Published

via MITRE·07:11 PM

Data Sourced

via MITRE·07:11 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:16 PM

DescriptionSeverityWeakness

Event

via NVD·07:16 PM

Frequently Asked Questions

What input must be processed for exploitation to be possible?

The affected FFmpeg instance must decode a crafted FLV file containing an FSV1 stream. The stream's zlib block data must decompress to less output than expected.

What information can be disclosed?

Uninitialized heap memory can be copied into decoded frames. An attacker may recover that memory from decoded output or from output that is subsequently re-encoded.

How can I identify deployments that need review?

Review FFmpeg deployments through version 9.0.2 that process FLV files, particularly where untrusted files may contain FSV1 streams. Focus on workflows that expose decoded frames or produce re-encoded media output.

CVE-2026-125175: FFmpeg through 9.0.2 Information Disclosure via Flash Screen Video Decoder

Affected Software

Event History

Frequently Asked Questions

What input must be processed for exploitation to be possible?

What information can be disclosed?

How can I identify deployments that need review?

Company

Resources

Contact

Frequently Asked Questions

What input must be processed for exploitation to be possible?

What information can be disclosed?

How can I identify deployments that need review?