CVE-2026-125098

CVE-2026-125098CVE-2026-125098

Description

FFmpeg through 9.0.2 contains an information disclosure vulnerability in vp8_lossy_decode_alpha() in libavcodec/webp.c that leaves alpha plane memory uninitialized for short uncompressed ALPH chunks. Attackers can supply a crafted WebP image whose ALPH chunk is shorter than width * height to disclose stale pixel data from previously decoded frames.

Scoring

CVSS 3.3 ()
VectorCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Last modified2026-11-09
Sourced from NVD. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.