CVE-2026-125193: FFmpeg through 9.0.2 Out-of-Bounds Read via bitpacked_decode_uyvy422()

Q: Which applications are exposed to this issue?

Applications using FFmpeg through 9.0.2 to decode bitpacked UYVY422 content are exposed. The affected inputs include crafted SDP/RFC 4175 RTP sessions and raw input.

Q: What does an attacker need to exploit the vulnerability?

An attacker needs to provide a truncated bitpacked UYVY422 packet. No privileges are required, but user interaction is required according to the supplied CVSS vector.

Q: What is the likely impact of successful exploitation?

A crafted truncated packet can cause an out-of-bounds read, potentially crashing the application or exposing adjacent heap memory. The provided severity data indicates low confidentiality impact and high availability impact.

Published Nov 9, 2026

Updated

FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in bitpackeddecodeuyvy422() in libavcodec/bitpackeddec.c because it never verifies packets hold width height 2 bytes. Attackers can supply truncated bitpacked UYVY422 packets via crafted SDP/RFC 4175 RTP sessions or raw input to crash applications or expose adjacent heap memory.

Affected Software

1 affected component

FFmpeg FFmpeg<=9.0.2

Event History

Nov 9, 2026

CVE Published

via MITRE·07:11 PM

Data Sourced

via MITRE·07:11 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which applications are exposed to this issue?

Applications using FFmpeg through 9.0.2 to decode bitpacked UYVY422 content are exposed. The affected inputs include crafted SDP/RFC 4175 RTP sessions and raw input.

What does an attacker need to exploit the vulnerability?

An attacker needs to provide a truncated bitpacked UYVY422 packet. No privileges are required, but user interaction is required according to the supplied CVSS vector.

What is the likely impact of successful exploitation?

A crafted truncated packet can cause an out-of-bounds read, potentially crashing the application or exposing adjacent heap memory. The provided severity data indicates low confidentiality impact and high availability impact.

CVE-2026-125193: FFmpeg through 9.0.2 Out-of-Bounds Read via bitpacked_decode_uyvy422()

Affected Software

Event History

Frequently Asked Questions

Which applications are exposed to this issue?

What does an attacker need to exploit the vulnerability?

What is the likely impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which applications are exposed to this issue?

What does an attacker need to exploit the vulnerability?

What is the likely impact of successful exploitation?