Uninitialized Memory Disclosure Vulnerability in FFmpeg's CineForm HD Decoder
CVE-2026-125268

4.8MEDIUM

Key Information:

Vendor

Ffmpeg

Status
Ffmpeg
Vendor
CVE Published:
9 November 2026

What is CVE-2026-125268?

FFmpeg versions up to 9.0.2 feature a vulnerability within the CineForm HD decoder that could allow attackers to disclose uninitialized memory. This issue arises when a malicious user supplies a crafted CFHD file containing an ImageHeight tag that exceeds the designated coded band heights, leading to the potential leakage of sensitive heap memory data through the decoded video output.

Affected Version(s)

FFmpeg 0 <= 9.0.2

References

https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25718
issue-tracking
https://github.com/FFmpeg/FFmpeg/commit/0bfa350291b2118f6...
patch
https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/c...
technical-description

CVSS V4

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Joshua Rogers (AISLE Research)
Michael Niedermayer
.