CVE-2026-125192

Description

FFmpeg through 9.0.2 contains an uninitialized memory vulnerability in the DXA decoder in libavcodec/dxa.c that allows attackers to disclose heap memory via crafted DXA files. Attackers can supply a DXA video with a type 4 frame that copies the uninitialized decomp_buf buffer into output pictures, exposing leftover heap contents in decoded frames.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

References

• https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24463 ↗
• https://github.com/FFmpeg/FFmpeg/commit/a6e5d5ff993a525933d8d8f29071eb6c74b0436a ↗
• https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/dxa.c#L341 ↗
• https://github.com/FFmpeg/FFmpeg ↗
• https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-heap-memory-disclosure-via-dxa-decoder-uninitialized-buffer ↗