PT-2026-141020
CVE-2026-125192
·
Published
2026-11-09
·
Updated
2026-11-09
Description by
CVSS 3.1
3.3
LowMetricsAV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
FFmpeg through 9.0.2 contains an uninitialized memory vulnerability in the DXA decoder in libavcodec/dxa.c that allows attackers to disclose heap memory via crafted DXA files. Attackers can supply a DXA video with a type 4 frame that copies the uninitialized decomp buf buffer into output pictures, exposing leftover heap contents in decoded frames.
Found an issue in the description? Have something to add? Feel free to write us 👾