PT-2026-140998
CVE-2026-125170
·
Published
2026-11-09
·
Updated
2026-11-09
Description by
CVSS 3.1
3.3
LowMetricsAV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in targa decode rle() in libavcodec/targa.c caused by missing packet length checks. Attackers can supply truncated RLE-compressed TGA images so decoded frames contain leftover heap buffer data and replicated uninitialized stack bytes.
Found an issue in the description? Have something to add? Feel free to write us 👾