PT-2026-141023
CVE-2026-125195
·
Published
2026-11-09
·
Updated
2026-11-09
Description by
CVSS 3.1
2.5
LowMetricsAV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in adpcm encode frame() in libavcodec/adpcmenc.c that leaks heap bytes when encoding mono ADPCM MS audio with trellis enabled. Attackers submitting audio to a service using this encoding receive output packets where about half of each block contains stale heap memory from the encoding process.
Found an issue in the description? Have something to add? Feel free to write us 👾