CVE-2026-125099

Description

FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in the GEM raster image decoder in libavcodec/gemdec.c that exposes uninitialized row-buffer bytes. Attackers can supply a crafted GEM .img image using SKIP or pattern opcodes to copy uninitialized heap memory into decoded frames, disclosing heap contents.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

References

• https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25715 ↗
• https://github.com/FFmpeg/FFmpeg/commit/e578999fa3c5f7efac1ea70bb7c2a7682013c7c9 ↗
• https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/gemdec.c#L258 ↗
• https://github.com/FFmpeg/FFmpeg ↗
• https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-uninitialized-memory-disclosure-via-gem-raster-decoder ↗