UBUNTU-CVE-2026-125190: Medium severity ubuntu/ffmpeg vulnerability

Published Nov 10, 2026

Updated

FFmpeg through 9.0.2 contains an information disclosure vulnerability in decodemvc2() in libavcodec/mvcdec.c that leaks uninitialized stack memory through unchecked palette indices. Attackers can supply a crafted MVC2 stream declaring few colors but referencing higher palette indices, copying process stack contents into decoded RGB frames.

Affected Software

7 affected components

ubuntu/ffmpeg*

Event History

Nov 10, 2026

CVE Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

What must an attacker do to exploit this issue?

They must provide a crafted MVC2 media stream that declares a small number of colors while referencing higher palette indices. Exploitation also requires a user or application to decode that stream.

What information could be exposed?

Unchecked palette indices can cause uninitialized process stack memory to be copied into decoded RGB frames. The stated impact is information disclosure; integrity and availability impacts are not indicated.

Which FFmpeg versions are identified as affected?

FFmpeg through version 9.0.2 is identified as affected.

UBUNTU-CVE-2026-125190: Medium severity ubuntu/ffmpeg vulnerability

Affected Software

Event History

Frequently Asked Questions

What must an attacker do to exploit this issue?

What information could be exposed?

Which FFmpeg versions are identified as affected?

Company

Resources

Contact

Frequently Asked Questions

What must an attacker do to exploit this issue?

What information could be exposed?

Which FFmpeg versions are identified as affected?