CVE-2026-125177: FFmpeg through 9.0.2 Uninitialized Heap Memory Disclosure via MSCC/SRGC Decoder

Q: Does exploitation require attacker authentication or user interaction?

The vector indicates no privileges are required, but user interaction is required. A crafted MSCC or SRGC stream must be processed by the vulnerable decoder.

Q: What types of content should be treated as potentially malicious?

MSCC or SRGC video streams with prematurely terminated RLE data are relevant. The description identifies AVI as one container that can carry such a stream.

Q: Is FFmpeg 9.0.2 affected?

Yes. The affected range is stated as FFmpeg through 9.0.2, so 9.0.2 is included.

Published Nov 9, 2026

Updated

FFmpeg through 9.0.2 contains an information disclosure vulnerability in the MSCC/SRGC decoder in libavcodec/mscc.c that outputs uninitialized heap bytes when RLE data ends early. Attackers can craft an MSCC or SRGC stream, such as in AVI, whose RLE data terminates early so the decoded frame exposes leftover heap memory to viewers of the output.

Affected Software

1 affected component

FFmpeg FFmpeg<=9.0.2

Event History

Nov 9, 2026

CVE Published

via MITRE·07:11 PM

Data Sourced

via MITRE·07:11 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Does exploitation require attacker authentication or user interaction?

The vector indicates no privileges are required, but user interaction is required. A crafted MSCC or SRGC stream must be processed by the vulnerable decoder.

What types of content should be treated as potentially malicious?

MSCC or SRGC video streams with prematurely terminated RLE data are relevant. The description identifies AVI as one container that can carry such a stream.

Is FFmpeg 9.0.2 affected?