CVE-2026-125179: FFmpeg through 9.0.2 Heap Memory Disclosure via VQA Video Decoder
FFmpeg through 9.0.2 contains an uninitialized memory vulnerability in the VQA video decoder in libavcodec/vqavideo.c that allows attackers to disclose heap memory via a crafted VQA file. Attackers can supply a Westwood VQA file omitting or truncating the CBF0/CBFZ codebook chunk, causing vqadecodeframe() to render frames from leftover heap bytes visible in decoded output.
Affected Software
Event History
Frequently Asked Questions
What must an attacker do to trigger the disclosure?
An attacker must cause FFmpeg to decode a crafted Westwood VQA file that omits or truncates the CBF0 or CBFZ codebook chunk. User interaction is required to open or otherwise process the malicious file.
What information can be exposed?
The decoder can render frame data from leftover heap memory into the decoded video output. The reported impact is limited to disclosure of heap memory; integrity and availability impacts are not indicated.
Which deployments are most exposed?
Deployments that decode untrusted or externally supplied Westwood VQA files are exposed, including workflows that automatically process uploaded media. The reported attack vector is local, so an attacker needs a path to provide the crafted file to a system that invokes FFmpeg decoding.
How can I determine whether a file is attempting to exploit this issue?
Inspect Westwood VQA inputs for missing or truncated CBF0 or CBFZ codebook chunks. Such files can cause the VQA decoder to use uninitialized codebook data when rendering frames.
What can be done before updating?
Avoid decoding untrusted Westwood VQA files, or disable or isolate processing paths that invoke the VQA decoder. Use the upstream fix referenced by commit f9df3577ac40aaee06f82f05eab8249cbab3cd33 when updating is possible.