CVE-2026-125098

FFmpeg through 9.0.2 contains an information disclosure vulnerability in vp8lossydecodealpha in libavcodec/webp.c that leaves alpha plane memory uninitialized for short uncompressed ALPH chunks. Attackers can supply a crafted WebP image whose ALPH chunk is shorter than width height to disclose...

CVE-2026-125098

FFmpeg versions through 9.0.2 are susceptible to an information disclosure vulnerability within the vp8_lossy_decode_alpha() function in libavcodec/webp.c . The root cause is that the software fails to initialize alpha plane memory for short uncompressed ALPH chunks . An attacker can exploit this...

PT-2026-140991

FFmpeg through 9.0.2 contains an information disclosure vulnerability in vp8 lossy decode alpha in libavcodec/webp.c that leaves alpha plane memory uninitialized for short uncompressed ALPH chunks. Attackers can supply a crafted WebP image whose ALPH chunk is shorter than width height to disclose...