UBUNTU-CVE-2026-125192: Medium severity ubuntu/ffmpeg vulnerability
FFmpeg through 9.0.2 contains an uninitialized memory vulnerability in the DXA decoder in libavcodec/dxa.c that allows attackers to disclose heap memory via crafted DXA files. Attackers can supply a DXA video with a type 4 frame that copies the uninitialized decompbuf buffer into output pictures, exposing leftover heap contents in decoded frames.
Affected Software
Event History
Frequently Asked Questions
What attacker interaction is required to trigger this issue?
An attacker needs to supply a crafted DXA video containing a type 4 frame and have it decoded by FFmpeg. The vulnerability requires user interaction, such as opening or processing the malicious file.
What information could be exposed?
The crafted frame can cause uninitialized heap memory from the decomp_buf buffer to be copied into decoded output pictures. This may disclose leftover heap contents through the resulting decoded frames.
Is this a remote code execution issue?
No. The provided severity vector indicates an impact to confidentiality only; integrity and availability impacts are listed as none.