CVE-2026-125268: FFmpeg through 9.0.2 Uninitialized Heap Memory Disclosure in CFHD Decoder
FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in the CineForm HD decoder that allows attackers to leak heap memory via unzeroed idwttmp buffers in libavcodec/cfhd.c. Attackers can supply a crafted CFHD file with an ImageHeight tag exceeding coded band heights, causing uninitialized heap bytes to be filtered into decoded video output.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications that use an affected FFmpeg version to decode attacker-controlled CineForm HD (CFHD) files are exposed. Exploitation requires a user or workflow to process a crafted CFHD file.
What does an attacker need to provide?
The attacker needs a crafted CFHD file whose ImageHeight tag exceeds the coded band heights. When FFmpeg decodes that file, uninitialized bytes from idwt_tmp heap buffers can be included in the decoded video output.
What can be done if updating is not immediately possible?
Avoid decoding untrusted CFHD files, or restrict CFHD decoding to trusted inputs until an updated FFmpeg version is deployed.
How can I determine whether my deployment is affected?
Check whether the FFmpeg build in use is version 9.0.2 or earlier and whether it decodes CFHD content. The vulnerable code is in libavcodec/cfhd.c and involves the idwt_tmp buffer handling.