CVE-2026-125190: FFmpeg through 9.0.2 Uninitialized Stack Memory Disclosure via MVC2 Decoder

Q: Which deployments are most exposed?

Deployments that use FFmpeg to decode MVC2 streams from untrusted sources are exposed, including applications that open or process user-supplied media. The affected range includes FFmpeg through 9.0.2.

Q: What does an attacker need to exploit this issue?

An attacker needs to provide a crafted MVC2 stream that declares a small palette but references higher palette indices. Exploitation requires the crafted media to be processed by the vulnerable MVC2 decoder; the supplied vector indicates user interaction is required.

Q: What is the practical impact of successful exploitation?

The decoder can copy uninitialized process stack memory into decoded RGB frames. This can disclose data from the FFmpeg process, but the provided information does not indicate integrity or availability impact.

Published Nov 9, 2026

Updated

FFmpeg through 9.0.2 contains an information disclosure vulnerability in decodemvc2() in libavcodec/mvcdec.c that leaks uninitialized stack memory through unchecked palette indices. Attackers can supply a crafted MVC2 stream declaring few colors but referencing higher palette indices, copying process stack contents into decoded RGB frames.

Affected Software

1 affected component

FFmpeg FFmpeg<=9.0.2

Event History

Nov 9, 2026

CVE Published

via MITRE·07:11 PM

Data Sourced

via MITRE·07:11 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are most exposed?

Deployments that use FFmpeg to decode MVC2 streams from untrusted sources are exposed, including applications that open or process user-supplied media. The affected range includes FFmpeg through 9.0.2.

What does an attacker need to exploit this issue?

An attacker needs to provide a crafted MVC2 stream that declares a small palette but references higher palette indices. Exploitation requires the crafted media to be processed by the vulnerable MVC2 decoder; the supplied vector indicates user interaction is required.

What is the practical impact of successful exploitation?

The decoder can copy uninitialized process stack memory into decoded RGB frames. This can disclose data from the FFmpeg process, but the provided information does not indicate integrity or availability impact.

CVE-2026-125190: FFmpeg through 9.0.2 Uninitialized Stack Memory Disclosure via MVC2 Decoder

Affected Software

Event History

Frequently Asked Questions

Which deployments are most exposed?

What does an attacker need to exploit this issue?

What is the practical impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are most exposed?

What does an attacker need to exploit this issue?

What is the practical impact of successful exploitation?