UBUNTU-CVE-2026-125193: Medium severity ubuntu/ffmpeg vulnerability

Published Nov 10, 2026

Updated

FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in bitpackeddecodeuyvy422() in libavcodec/bitpackeddec.c because it never verifies packets hold width height 2 bytes. Attackers can supply truncated bitpacked UYVY422 packets via crafted SDP/RFC 4175 RTP sessions or raw input to crash applications or expose adjacent heap memory.

Affected Software

7 affected components

ubuntu/ffmpeg*

Event History

Nov 10, 2026

CVE Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are exposed to this issue?

Applications using FFmpeg to decode bitpacked UYVY422 video are exposed when they process raw input or RTP media supplied through SDP/RFC 4175 sessions. The issue affects FFmpeg through version 9.0.2.

What does an attacker need to exploit it?

An attacker needs to cause the application to decode a truncated bitpacked UYVY422 packet. This can be delivered through a crafted SDP/RFC 4175 RTP session or crafted raw input, and does not require prior privileges, although user interaction is indicated by the supplied severity vector.

What is the likely impact?

Processing the malformed packet can cause an application crash or expose adjacent heap memory through an out-of-bounds read. The supplied vector indicates high availability impact and low confidentiality impact, with no integrity impact.

UBUNTU-CVE-2026-125193: Medium severity ubuntu/ffmpeg vulnerability

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

What is the likely impact?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

What is the likely impact?