CVE-2026-125266

CVE-2026-125266CVE-2026-125266

Description

FFmpeg through 9.0.2 contains an uninitialized stack memory disclosure vulnerability in old_codec23() of libavcodec/sanm.c that leaks stack bytes into decoded frames. Attackers can supply a crafted LucasArts SMUSH/SANM animation using codec 23 with an inline table to expose decoder process stack memory in output video.

Scoring

CVSS 3.3 ()
VectorCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Last modified2026-11-09
Sourced from NVD. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.