CVE-2026-125095

Description

FFmpeg through 9.0.2 contains an uninitialized memory use vulnerability in the C93 video decoder in libavcodec/c93.c, where decode_frame() never checks how many color table bytes were copied. Attackers can supply a crafted truncated Interplay C93 file so draw_n_color() writes uninitialized stack bytes into decoded frames, disclosing stack memory contents.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

References

• https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25715 ↗
• https://github.com/FFmpeg/FFmpeg/commit/ac0106851a4dac555c967421dfc96c0135183133 ↗
• https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/c93.c#L198 ↗
• https://github.com/FFmpeg/FFmpeg ↗
• https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-c93-decoder-uninitialized-stack-memory-disclosure ↗