CVE-2026-125243: FFmpeg through 9.0.2 Uninitialized Memory Disclosure via JPEG-LS Decoder

Q: What input is required to trigger the disclosure?

An attacker must provide a crafted single-component JPEG-LS image with the ILV byte set to 1. Exploitation occurs when FFmpeg decodes this input through the affected JPEG-LS decoder path.

Q: What information can be exposed?

The decoder can produce GRAY16 frames containing leftover heap memory because uninitialized memory is disclosed. The provided data identifies confidentiality impact only; it does not describe integrity or availability effects.

Q: Are remote or unauthenticated attacks possible?

The supplied severity vector indicates local attack vector, no privileges required, and user interaction required. In practice, a user or application must be induced to process the crafted image.

Q: Which FFmpeg versions are identified as affected?

The issue is described as affecting FFmpeg through version 9.0.2. A referenced upstream commit is provided, but the supplied data does not state the first fixed release version.

Published Nov 9, 2026

Updated

FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in ffjpeglsdecodepicture() in libavcodec/jpeglsdec.c, which decodes 16-bit line-interleaved JPEG-LS scans as 8-bit samples. Attackers can supply a crafted single-component JPEG-LS image with the ILV byte set to 1, causing decoded GRAY16 frames to expose leftover heap memory.

Affected Software

1 affected component

FFmpeg FFmpeg<=9.0.2

Event History

Nov 9, 2026

CVE Published

via MITRE·07:11 PM

Data Sourced

via MITRE·07:11 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What input is required to trigger the disclosure?

An attacker must provide a crafted single-component JPEG-LS image with the ILV byte set to 1. Exploitation occurs when FFmpeg decodes this input through the affected JPEG-LS decoder path.

What information can be exposed?

The decoder can produce GRAY16 frames containing leftover heap memory because uninitialized memory is disclosed. The provided data identifies confidentiality impact only; it does not describe integrity or availability effects.

Are remote or unauthenticated attacks possible?

The supplied severity vector indicates local attack vector, no privileges required, and user interaction required. In practice, a user or application must be induced to process the crafted image.

Which FFmpeg versions are identified as affected?

The issue is described as affecting FFmpeg through version 9.0.2. A referenced upstream commit is provided, but the supplied data does not state the first fixed release version.

CVE-2026-125243: FFmpeg through 9.0.2 Uninitialized Memory Disclosure via JPEG-LS Decoder

Affected Software

Event History

Frequently Asked Questions

What input is required to trigger the disclosure?

What information can be exposed?

Are remote or unauthenticated attacks possible?

Which FFmpeg versions are identified as affected?

Company

Resources

Contact

Frequently Asked Questions

What input is required to trigger the disclosure?

What information can be exposed?

Are remote or unauthenticated attacks possible?

Which FFmpeg versions are identified as affected?