CVE-2026-125176: FFmpeg through 9.0.2 Uninitialized Memory Read in Flash Screen Video 2 Decoder

Q: What must an attacker provide to trigger the issue?

An attacker must cause FFmpeg to decode a crafted Flash Screen Video 2 block. The block's decompressed data must end in the middle of a 15-bit color pixel.

Q: What could an attacker obtain if exploitation succeeds?

The out-of-bounds read can leak heap memory into decoded output frames. The provided information describes information disclosure, not modification of data or denial of service.

Q: Does exploitation require prior privileges or user interaction?

The supplied CVSS vector indicates no privileges are required and user interaction is required. The attack vector is local.

Q: Which FFmpeg versions are identified as affected?

The issue is reported in FFmpeg through version 9.0.2. The provided commit reference is 16d0f7f408ba47b4091a22109d4f22f5fd57820a.

Published Nov 9, 2026

Updated

FFmpeg through 9.0.2 contains an uninitialized memory read vulnerability in decodehybrid() in libavcodec/flashsv.c that reads past decompressed data when decoding 15-bit color pixels. Attackers can supply a crafted Flash Screen Video 2 block whose inflated data ends mid-pixel to leak heap memory into decoded output frames.

Affected Software

1 affected component

FFmpeg FFmpeg<=9.0.2

Event History

Nov 9, 2026

CVE Published

via MITRE·07:11 PM

Data Sourced

via MITRE·07:11 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What must an attacker provide to trigger the issue?

An attacker must cause FFmpeg to decode a crafted Flash Screen Video 2 block. The block's decompressed data must end in the middle of a 15-bit color pixel.

What could an attacker obtain if exploitation succeeds?

The out-of-bounds read can leak heap memory into decoded output frames. The provided information describes information disclosure, not modification of data or denial of service.

Does exploitation require prior privileges or user interaction?

The supplied CVSS vector indicates no privileges are required and user interaction is required. The attack vector is local.

Which FFmpeg versions are identified as affected?

The issue is reported in FFmpeg through version 9.0.2. The provided commit reference is 16d0f7f408ba47b4091a22109d4f22f5fd57820a.

CVE-2026-125176: FFmpeg through 9.0.2 Uninitialized Memory Read in Flash Screen Video 2 Decoder

Affected Software

Event History

Frequently Asked Questions

What must an attacker provide to trigger the issue?

What could an attacker obtain if exploitation succeeds?

Does exploitation require prior privileges or user interaction?

Which FFmpeg versions are identified as affected?

Company

Resources

Contact

Frequently Asked Questions

What must an attacker provide to trigger the issue?

What could an attacker obtain if exploitation succeeds?

Does exploitation require prior privileges or user interaction?

Which FFmpeg versions are identified as affected?