CVE-2026-125266: FFmpeg through 9.0.2 Uninitialized Stack Memory Disclosure via SANM Codec 23
FFmpeg through 9.0.2 contains an uninitialized stack memory disclosure vulnerability in oldcodec23() of libavcodec/sanm.c that leaks stack bytes into decoded frames. Attackers can supply a crafted LucasArts SMUSH/SANM animation using codec 23 with an inline table to expose decoder process stack memory in output video.
Affected Software
Event History
Frequently Asked Questions
What must an attacker provide to trigger the disclosure?
An attacker must supply a crafted LucasArts SMUSH/SANM animation that uses codec 23 with an inline table. Exploitation requires a user or process to decode that animation with the affected FFmpeg code.
What information can be exposed?
The flaw can leak uninitialized stack bytes from the decoder process into decoded video frames. The provided data describes confidentiality impact only; it does not indicate integrity or availability impact.
Are remote FFmpeg services affected?
The supplied severity vector identifies local attack vector and user interaction as required. The available data does not establish that a network-accessible FFmpeg deployment is directly exploitable without handling a crafted animation.