UBUNTU-CVE-2026-125171: Medium severity ubuntu/ffmpeg vulnerability
FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in the Musepack SV7 decoder because mpc7decodeinit() does not validate lastframelen against MPCFRAMESIZE. Attackers can supply a crafted Musepack SV7 file declaring an oversized final frame, causing consumers of decoded frames to read past the audio buffer, leading to crashes or heap memory disclosure.
Affected Software
Event History
Frequently Asked Questions
What attacker interaction is required?
An attacker needs to provide a crafted Musepack SV7 audio file with an oversized declared final frame and have a user or application decode it. The issue is locally exploitable with no privileges required, but user interaction is required.
What is the likely impact if a vulnerable decoder processes a malicious file?
Consumers of decoded frames may read beyond the audio buffer. This can cause a crash or disclose heap memory.
Which FFmpeg component should be assessed for exposure?
Assess workflows that decode Musepack SV7 audio using FFmpeg, particularly where untrusted or externally supplied audio files are processed. The vulnerable logic is in the Musepack SV7 decoder's mpc7_decode_init() handling of the final frame length.