Dashboard / CVE-2026-125266

CVE-2026-125266

MEDIUM
MEDIUM Priority: 0.01 BB Relevance: 35/100
Published: 2026-11-09 Modified: 2026-11-13 First seen: 2026-11-09 Status: active

Attack Surface

Low Complexity No Auth

CVSS Vector Breakdown

AV: Local
AC: Low
PR: None
UI: Passive
AT: None
VC: Low
VI: None
VA: None

Description

FFmpeg through 9.0.2 contains an uninitialized stack memory disclosure vulnerability in old_codec23() of libavcodec/sanm.c that leaks stack bytes into decoded frames. Attackers can supply a crafted LucasArts SMUSH/SANM animation using codec 23 with an inline table to expose decoder process stack memory in output video.

Weakness Classification (1)

Affected Software (2)

VendorProductVersion
FFmpeg FFmpeg 8.0
FFmpeg FFmpeg 8.0

References & Advisories (5)

Bug Bounty Relevance

35 / 100
✓ No authentication
✓ Low complexity

CVSS Score

4.8 / 10.0 v4.0
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

EPSS — Exploitation Probability

0.13%
Raw Score 0.001280
Percentile 2.5%
Date 2026-11-13

EPSS Trend

2026-11-13
0.00128
2026-11-12
0.00128
2026-11-10
0.00128

Intelligence Sources

mitre ref →
nvd ref →

External Links