UBUNTU-CVE-2026-125179: Medium severity ubuntu/ffmpeg vulnerability

Published Nov 10, 2026

Updated

FFmpeg through 9.0.2 contains an uninitialized memory vulnerability in the VQA video decoder in libavcodec/vqavideo.c that allows attackers to disclose heap memory via a crafted VQA file. Attackers can supply a Westwood VQA file omitting or truncating the CBF0/CBFZ codebook chunk, causing vqadecodeframe() to render frames from leftover heap bytes visible in decoded output.

Affected Software

7 affected components

ubuntu/ffmpeg*

Event History

Nov 10, 2026

CVE Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who is exposed to this issue?

Systems using FFmpeg to decode Westwood VQA video files are exposed when they process attacker-supplied VQA content. Exploitation requires local access and user interaction, such as opening or otherwise causing the crafted file to be decoded.

What does an attacker need to include in a malicious file?

The attacker needs to supply a crafted Westwood VQA file with a missing or truncated CBF0 or CBFZ codebook chunk. When FFmpeg decodes the file, the VQA decoder can render leftover heap memory into the decoded output.

What information could be exposed?

The issue can disclose heap memory through decoded video frames. The provided data indicates confidentiality impact only; it does not indicate integrity or availability impact.

UBUNTU-CVE-2026-125179: Medium severity ubuntu/ffmpeg vulnerability

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to include in a malicious file?

What information could be exposed?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to include in a malicious file?

What information could be exposed?