CVE-2026-125266

LowCVSS 3.3/10Last modified Nov 10, 2026

Description

FFmpeg through 9.0.2 contains an uninitialized stack memory disclosure vulnerability in old_codec23() of libavcodec/sanm.c that leaks stack bytes into decoded frames. Attackers can supply a crafted LucasArts SMUSH/SANM animation using codec 23 with an inline table to expose decoder process stack memory in output video.

Metrics

CVSS 3.1 3.3/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-908

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
FFmpeg	FFmpeg	>= 8.0, <= 9.0.2

References

Timeline

Published: Nov 9, 2026
Last modified: Nov 10, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-1252677.8FFmpeg before 8.1.3 and 9.x before 9.0.2 contains a heap out-of-bounds write vulnerability in the APAC decoder in libavcodec/apac.c caused b CVE-2026-1252683.3FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in the CineForm HD decoder that allows attackers to leak heap CVE-2026-1252697.0FFmpeg through 9.0.2 contains a double free vulnerability in libavcodec/cbs_sei.c where cbs_sei_delete_message() leaves a stale extension_da CVE-2026-125276.0A broken authorization boundary in the RTSP media delivery pipeline of Shenzhen Liandian Communication Technology LTD V380 IP Camera firmwar CVE-2026-1252705.3FFmpeg through 9.0.2 contains a heap out-of-bounds read vulnerability in v4l2_buffer_swframe_to_buf() in libavcodec/v4l2_buffers.c that mish CVE-2026-1252717.8Incorrect normalization of operation names in the custom security policy enforcement in awslabs aws-api-mcp-server before 1.5.1 might allow CVE-2026-125285.4A flaw was found in 389 Directory Server in the __aclp__normalize_acltxt() function of aclparse.c. A malformed ACI (Access Control Instructi CVE-2026-1252858.8Authentication bypass using an alternate path or channel vulnerability in TIBCO TIBCO Platform’s Self-Hosted Control Plane. This issue affe CVE-2026-125297.3A security vulnerability has been detected in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. Affected is an u CVE-2026-1252979.8AsiaInfo Business Support System (BSS) 9.2.0 through 9.2.40 accepts unauthenticated requests via the management API '/bss/sysmgnt/api/'. A r CVE-2026-1252989.8AsiaInfo Business Support System (BSS) 9.2.0 through 9.2.40 does not correctly verify cryptographic signatures for JSON Web Tokens (JWT). A CVE-2026-12534.3The Group Chat & Video Chat by AtomChat plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability