UBUNTU-CVE-2026-125101: Medium severity ubuntu/ffmpeg vulnerability
FFmpeg through 9.0.2 contains an information disclosure vulnerability in the VMnc decoder in libavcodec/vmnc.c that restores an unwritten cursor save area into later frames. Attackers can supply a crafted VMnc stream where a frame fails after loading a cursor shape, causing uninitialized heap bytes from screendta to appear in decoded output.
Affected Software
Event History
Frequently Asked Questions
What must an attacker provide to trigger the disclosure?
An attacker must supply a crafted VMnc stream. The issue is triggered when a frame fails after loading a cursor shape, allowing uninitialized heap bytes from screendta to appear in decoded output.
What information can be exposed?
The decoded output may contain uninitialized heap memory bytes from the screendta buffer. The provided data does not indicate modification of data or denial-of-service impact.
Does exploitation require authentication or user interaction?
The vector is local and requires no privileges or authentication. The CVSS vector indicates user interaction is required.