UBUNTU-CVE-2026-125176: Medium severity ubuntu/ffmpeg vulnerability

Published Nov 10, 2026

Updated

FFmpeg through 9.0.2 contains an uninitialized memory read vulnerability in decodehybrid() in libavcodec/flashsv.c that reads past decompressed data when decoding 15-bit color pixels. Attackers can supply a crafted Flash Screen Video 2 block whose inflated data ends mid-pixel to leak heap memory into decoded output frames.

Affected Software

7 affected components

ubuntu/ffmpeg*

Event History

Nov 10, 2026

CVE Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

What must an attacker provide to trigger the issue?

An attacker must supply a crafted Flash Screen Video 2 block that uses 15-bit color pixels and whose decompressed data ends in the middle of a pixel. Triggering it requires the affected content to be decoded by FFmpeg.

What is the likely impact of successful exploitation?

The out-of-bounds uninitialized memory read can leak heap memory into decoded output frames. The provided severity vector indicates confidentiality impact, with no stated integrity or availability impact.

Is user interaction required?

Yes. The supplied severity vector marks user interaction as required, indicating that a user must be involved in processing the crafted content.

UBUNTU-CVE-2026-125176: Medium severity ubuntu/ffmpeg vulnerability

Affected Software

Event History

Frequently Asked Questions

What must an attacker provide to trigger the issue?

What is the likely impact of successful exploitation?

Is user interaction required?

Company

Resources

Contact

Frequently Asked Questions

What must an attacker provide to trigger the issue?

What is the likely impact of successful exploitation?

Is user interaction required?