UBUNTU-CVE-2026-125095: Medium severity ubuntu/ffmpeg vulnerability
FFmpeg through 9.0.2 contains an uninitialized memory use vulnerability in the C93 video decoder in libavcodec/c93.c, where decodeframe() never checks how many color table bytes were copied. Attackers can supply a crafted truncated Interplay C93 file so drawncolor() writes uninitialized stack bytes into decoded frames, disclosing stack memory contents.
Affected Software
Event History
Frequently Asked Questions
What conditions are required to exploit this issue?
An attacker needs to provide a crafted, truncated Interplay C93 media file and have it decoded by the affected FFmpeg C93 decoder. The CVSS vector indicates local attack access and user interaction are required, while no privileges are required.
What is the likely impact if exploitation succeeds?
The decoder can write uninitialized stack bytes into decoded video frames, potentially disclosing stack memory contents. The supplied severity vector indicates confidentiality impact only, with no integrity or availability impact.
How can I determine whether a system may be affected?
Systems using Ubuntu's FFmpeg package may be affected if they use the C93 decoder and process Interplay C93 files. The issue is described as affecting FFmpeg through version 9.0.2.