CVE-2026-125243

Description

FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in ff_jpegls_decode_picture() in libavcodec/jpeglsdec.c, which decodes 16-bit line-interleaved JPEG-LS scans as 8-bit samples. Attackers can supply a crafted single-component JPEG-LS image with the ILV byte set to 1, causing decoded GRAY16 frames to expose leftover heap memory.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

References

• https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25303 ↗
• https://github.com/FFmpeg/FFmpeg/commit/60bc31fcf6543505e6d2fc1a9399cca95f54ba4d ↗
• https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/jpeglsdec.c#L483 ↗
• https://github.com/FFmpeg/FFmpeg ↗
• https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-uninitialized-memory-disclosure-via-jpeg-ls-decoder ↗