CVE-2026-125217: FFmpeg through 9.0.2 RoQ DPCM Encoder Uninitialized Heap Memory Disclosure

Q: What conditions are required to trigger the disclosure?

An attacker needs to cause RoQ DPCM transcoding of a short audio stream containing fewer than eight frames, resulting in an early encoder flush. The issue is in the RoQ DPCM encoder path, not merely in processing audio input.

Q: What could be disclosed if exploitation succeeds?

Output packets can contain DPCM-quantized stale heap contents from the encoder's frame_buffer. The reported impact is limited to confidentiality; no integrity or availability impact is specified.

Q: Is user interaction required?

Yes. The supplied severity vector specifies user interaction as required, while no privileges are required and attack complexity is low.

Q: Which FFmpeg releases are identified as affected?

The affected range is stated as FFmpeg through 9.0.2. The provided references include a commit associated with the fix, but no fixed release version is specified.

Published Nov 9, 2026

Updated

FFmpeg through 9.0.2 contains an uninitialized memory use vulnerability in roqdpcmencodeframe() in libavcodec/roqaudioenc.c that encodes stale heap contents when flushed early. Attackers can supply short audio streams under eight frames for RoQ DPCM transcoding, causing DPCM-quantized uninitialized heap data from framebuffer to leak into output packets.

Affected Software

1 affected component

FFmpeg FFmpeg<=9.0.2

Event History

Nov 9, 2026

CVE Published

via MITRE·07:11 PM

Data Sourced

via MITRE·07:11 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What conditions are required to trigger the disclosure?

An attacker needs to cause RoQ DPCM transcoding of a short audio stream containing fewer than eight frames, resulting in an early encoder flush. The issue is in the RoQ DPCM encoder path, not merely in processing audio input.

What could be disclosed if exploitation succeeds?

Output packets can contain DPCM-quantized stale heap contents from the encoder's frame_buffer. The reported impact is limited to confidentiality; no integrity or availability impact is specified.

Is user interaction required?

Yes. The supplied severity vector specifies user interaction as required, while no privileges are required and attack complexity is low.

Which FFmpeg releases are identified as affected?

The affected range is stated as FFmpeg through 9.0.2. The provided references include a commit associated with the fix, but no fixed release version is specified.

CVE-2026-125217: FFmpeg through 9.0.2 RoQ DPCM Encoder Uninitialized Heap Memory Disclosure

Affected Software

Event History

Frequently Asked Questions

What conditions are required to trigger the disclosure?

What could be disclosed if exploitation succeeds?

Is user interaction required?

Which FFmpeg releases are identified as affected?

Company

Resources

Contact

Frequently Asked Questions

What conditions are required to trigger the disclosure?

What could be disclosed if exploitation succeeds?

Is user interaction required?

Which FFmpeg releases are identified as affected?