UBUNTU-CVE-2026-125099: Medium severity ubuntu/ffmpeg vulnerability
FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in the GEM raster image decoder in libavcodec/gemdec.c that exposes uninitialized row-buffer bytes. Attackers can supply a crafted GEM .img image using SKIP or pattern opcodes to copy uninitialized heap memory into decoded frames, disclosing heap contents.
Affected Software
Event History
Frequently Asked Questions
What access or interaction is required to exploit this issue?
An attacker needs to provide a crafted GEM .img image that is processed by FFmpeg. The vector is local and user interaction is required, according to the supplied severity data.
What information could be exposed?
The issue can copy uninitialized heap memory into decoded image frames, potentially disclosing heap contents. The provided impact data indicates confidentiality impact only, with no stated integrity or availability impact.
Which component should be reviewed for exposure?
Review FFmpeg deployments that decode GEM raster images through the GEM decoder in libavcodec/gemdec.c. The vulnerability is described as affecting FFmpeg through version 9.0.2.