Description
FFmpeg through 9.0.2 contains an information disclosure vulnerability in decode_mvc2() in libavcodec/mvcdec.c that leaks uninitialized stack memory through unchecked palette indices. Attackers can supply a crafted MVC2 stream declaring few colors but referencing higher palette indices, copying process stack contents into decoded RGB frames.
Published: 2026-11-09
Score: 4.8 Medium
EPSS: n/a
KEV: No
Impact: Information Disclosure
Action: Upgrade
AI Analysis

Impact

This vulnerability allows leakage of uninitialized stack memory due to unchecked palette indices in MVC2 streams. The decode_mvc2() function in libavcodec/mvcdec.c copies residual stack data into decoded RGB frames, exposing the contents of the process stack. While the description does not specify what the stack holds, the potential to reveal sensitive data is inferred. The weakness is classified as CWE-908.

Affected Systems

FFmpeg releases through version 9.0.2 are impacted when the MVC2 decoder processes video streams. Any system running FFmpeg 9.0.2 or earlier that decodes MVC2 streams is vulnerable, regardless of operating system or platform.

Risk and Exploitability

The CVSS score of 4.8 indicates a medium severity rating. The EPSS score is not available, so the likelihood of exploitation isn’t quantifiable from the data. The vulnerability is not listed in CISA’s KEV catalog. Attackers must supply a crafted MVC2 stream to the application using the affected FFmpeg build; the exploit requires no elevated privileges beyond the application's execution context. The attack primarily enables information disclosure rather than code execution.

Generated by OpenCVE AI on November 9, 2026 at 22:10 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Deploy a patched FFmpeg release (e.g., 9.0.3 or later) that fixes the uninitialized stack memory issue in MVC2 decoding.
  • If upgrading is temporarily unavailable, disable MVC2 decoding or restrict the application from receiving MVC2 streams from untrusted sources.
  • Implement additional validation for palette indices to ensure they do not exceed the declared palette size before rendering frames.

Generated by OpenCVE AI on November 9, 2026 at 22:10 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 09 Nov 2026 19:15:00 +0000

Type Values Removed Values Added
Description FFmpeg through 9.0.2 contains an information disclosure vulnerability in decode_mvc2() in libavcodec/mvcdec.c that leaks uninitialized stack memory through unchecked palette indices. Attackers can supply a crafted MVC2 stream declaring few colors but referencing higher palette indices, copying process stack contents into decoded RGB frames.
Title FFmpeg through 9.0.2 Uninitialized Stack Memory Disclosure via MVC2 Decoder
First Time appeared Ffmpeg
Ffmpeg ffmpeg
Weaknesses CWE-908
CPEs cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*
Vendors & Products Ffmpeg
Ffmpeg ffmpeg
References
Metrics cvssV3_1

{'score': 3.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N'}

cvssV4_0

{'score': 4.8, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Ffmpeg Ffmpeg
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-11-09T19:11:13.086Z

Reserved: 2026-11-09T18:15:08.687Z

Link: CVE-2026-125190

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-11-09T19:16:54.777

Modified: 2026-11-09T19:16:54.777

Link: CVE-2026-125190

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-09T23:45:16Z

Weaknesses
  • CWE-908

    Use of Uninitialized Resource