CVE-2026-125179

Description

FFmpeg through 9.0.2 contains an uninitialized memory vulnerability in the VQA video decoder in libavcodec/vqavideo.c that allows attackers to disclose heap memory via a crafted VQA file. Attackers can supply a Westwood VQA file omitting or truncating the CBF0/CBFZ codebook chunk, causing vqa_decode_frame() to render frames from leftover heap bytes visible in decoded output.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

References

• https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24670 ↗
• https://github.com/FFmpeg/FFmpeg/commit/f9df3577ac40aaee06f82f05eab8249cbab3cd33 ↗
• https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/vqavideo.c#L186 ↗
• https://github.com/FFmpeg/FFmpeg ↗
• https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-heap-memory-disclosure-via-vqa-video-decoder ↗