UBUNTU-CVE-2026-125097: Medium severity ubuntu/ffmpeg vulnerability
FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in rawdecode() in libavcodec/rawdec.c that fails to verify packet stride covers a full row for 1 to 8 bits per pixel video. Attackers can supply crafted AVI, MOV or NUT files with truncated low bit depth rawvideo packets to leak uninitialized heap memory through decoded frame output.
Affected Software
Event History
Frequently Asked Questions
What input must an attacker control to exploit this issue?
The attacker must be able to supply a crafted AVI, MOV, or NUT file containing truncated low-bit-depth rawvideo packets. Exploitation relies on decoding rawvideo with 1 to 8 bits per pixel.
What is the impact of successful exploitation?
Successful exploitation can disclose uninitialized heap memory through decoded frame output. The provided severity data indicates confidentiality impact only; integrity and availability impacts are not indicated.
Does exploitation require authentication or direct network access?
The provided vector indicates no privileges are required and the attack complexity is low. User interaction is required, and the attack vector is local, consistent with a user or application opening a malicious media file.
Which FFmpeg versions are reported as affected?
The issue is reported in FFmpeg through version 9.0.2. The provided data does not identify an Ubuntu package version containing a fix.