Uninitialized Memory Disclosure in FFmpeg, Affected by JPEG-LS Image Processing
CVE-2026-125243

4.8MEDIUM

Key Information:

Vendor

Ffmpeg

Status
Ffmpeg
Vendor
CVE Published:
9 November 2026

What is CVE-2026-125243?

FFmpeg, in versions up to 9.0.2, is vulnerable to an uninitialized memory disclosure due to an issue in the JPEG-LS decoder within the libavcodec library. When processing specifically crafted 16-bit line-interleaved JPEG-LS images, attackers can manipulate the ILV byte, leading to the exposure of residual data from the heap memory in decoded GRAY16 frames. This can potentially allow attackers to glean sensitive information from the system memory.

Affected Version(s)

FFmpeg 0 <= 9.0.2

References

https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25303
issue-tracking
https://github.com/FFmpeg/FFmpeg/commit/60bc31fcf6543505e...
patch
https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/j...
technical-description

CVSS V4

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Joshua Rogers (AISLE Research)
Martin Mirchev
.