CVE-2026-125184

Name of the Vulnerable Software and Affected Versions FFmpeg versions 6.1 through 9.0.2

Description An information disclosure issue exists in the CamStudio decoder (libavcodec/cscd.c). The flaw occurs when decompressed payloads are shorter than the frame size, causing uninitialized heap memory to be copied into decoded frames. An attacker can exploit this by providing a specially crafted AVI file containing a CSCD stream where LZO or zlib frames decompress to fewer bytes than the expected frame size, allowing the recovery of heap contents from the decoded or re-encoded output.

Recommendations Update FFmpeg to a version newer than 9.0.2.