Dashboard / CVE-2026-125097

CVE-2026-125097

MEDIUM
MEDIUM Priority: 0.01 BB Relevance: 35/100
Published: 2026-11-09 Modified: 2026-11-13 First seen: 2026-11-09 Status: active

Attack Surface

Low Complexity No Auth

CVSS Vector Breakdown

AV: Local
AC: Low
PR: None
UI: Passive
S: X
AT: None
VC: Low
VI: None
VA: None

Description

FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in raw_decode() in libavcodec/rawdec.c that fails to verify packet stride covers a full row for 1 to 8 bits per pixel video. Attackers can supply crafted AVI, MOV or NUT files with truncated low bit depth rawvideo packets to leak uninitialized heap memory through decoded frame output.

Weakness Classification (1)

Affected Software (2)

VendorProductVersion
FFmpeg FFmpeg 0
FFmpeg FFmpeg 0

References & Advisories (5)

Bug Bounty Relevance

35 / 100
✓ No authentication
✓ Low complexity

CVSS Score

4.8 / 10.0 v4.0
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

0.13%
Raw Score 0.001280
Percentile 2.5%
Date 2026-11-13

EPSS Trend

2026-11-13
0.00128
2026-11-12
0.00128
2026-11-10
0.00128

Intelligence Sources

mitre ref →
nvd ref →

External Links