CVE-2026-125095 FFmpeg through 9.0.2 C93 Decoder Uninitialized Stack Memory Disclosure

FFmpeg through 9.0.2 contains an uninitialized memory use vulnerability in the C93 video decoder in libavcodec/c93.c, where decodeframe never checks how many color table bytes were copied. Attackers can supply a crafted truncated Interplay C93 file so drawncolor writes uninitialized stack bytes...

CVE-2026-125095 FFmpeg through 9.0.2 C93 Decoder Uninitialized Stack Memory Disclosure

FFmpeg through 9.0.2 contains an uninitialized memory use vulnerability in the C93 video decoder in libavcodec/c93.c, where decodeframe never checks how many color table bytes were copied. Attackers can supply a crafted truncated Interplay C93 file so drawncolor writes uninitialized stack bytes...

PT-2026-140988

FFmpeg through 9.0.2 contains an uninitialized memory use vulnerability in the C93 video decoder in libavcodec/c93.c, where decode frame never checks how many color table bytes were copied. Attackers can supply a crafted truncated Interplay C93 file so draw n color writes uninitialized stack byte...