CVE-2026-125171

Description

FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in the Musepack SV7 decoder because mpc7_decode_init() does not validate lastframelen against MPC_FRAME_SIZE. Attackers can supply a crafted Musepack SV7 file declaring an oversized final frame, causing consumers of decoded frames to read past the audio buffer, leading to crashes or heap memory disclosure.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

References

• https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25074 ↗
• https://github.com/FFmpeg/FFmpeg/commit/5d59b7c45d7142bddd13ddc8891e72c5c7dc991b ↗
• https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/mpc7.c#L281 ↗
• https://github.com/FFmpeg/FFmpeg ↗
• https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-out-of-bounds-read-in-musepack-sv7-decoder-via-mpc7-c ↗