CVE-2026-125195

Description

FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in adpcm_encode_frame() in libavcodec/adpcmenc.c that leaks heap bytes when encoding mono ADPCM_MS audio with trellis enabled. Attackers submitting audio to a service using this encoding receive output packets where about half of each block contains stale heap memory from the encoding process.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

References

• https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25694 ↗
• https://github.com/FFmpeg/FFmpeg/commit/fb13409aaffc151f602ad357db46052e98ea46e8 ↗
• https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/adpcmenc.c#L785 ↗
• https://github.com/FFmpeg/FFmpeg ↗
• https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-uninitialized-memory-disclosure-via-adpcm-ms-trellis-encoding ↗