CVE-2026-125171

FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in the Musepack SV7 decoder because mpc7decodeinit does not validate lastframelen against MPCFRAMESIZE. Attackers can supply a crafted Musepack SV7 file declaring an oversized final frame, causing consumers of decoded frames to rea...

CVE-2026-125171 FFmpeg through 9.0.2 Out-of-Bounds Read in Musepack SV7 Decoder via mpc7.c

FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in the Musepack SV7 decoder because mpc7decodeinit does not validate lastframelen against MPCFRAMESIZE. Attackers can supply a crafted Musepack SV7 file declaring an oversized final frame, causing consumers of decoded frames to rea...

CVE-2026-125171 FFmpeg through 9.0.2 Out-of-Bounds Read in Musepack SV7 Decoder via mpc7.c

FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in the Musepack SV7 decoder because mpc7decodeinit does not validate lastframelen against MPCFRAMESIZE. Attackers can supply a crafted Musepack SV7 file declaring an oversized final frame, causing consumers of decoded frames to rea...

CVE-2026-125171

Versions of FFmpeg through 9.0.2 are affected by an out-of-bounds read vulnerability in the Musepack SV7 decoder . The root cause is that the mpc7_decode_init() function fails to validate lastframelen against MPC_FRAME_SIZE. An attacker can provide a crafted Musepack SV7 file with an oversized fi...

EUVD-2026-120260

FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in the Musepack SV7 decoder because mpc7decodeinit does not validate lastframelen against MPCFRAMESIZE. Attackers can supply a crafted Musepack SV7 file declaring an oversized final frame, causing consumers of decoded frames to rea...

PT-2026-140999

FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in the Musepack SV7 decoder because mpc7 decode init does not validate lastframelen against MPC FRAME SIZE. Attackers can supply a crafted Musepack SV7 file declaring an oversized final frame, causing consumers of decoded frames to...

CVE-2026-125171: FFmpeg: FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in the Musepack SV7 decoder because…

FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in the Musepack SV7 decoder because mpc7decodeinit does not validate lastframelen against MPCFRAMESIZE. Attackers can supply a crafted Musepack SV7 file declaring an oversized final frame, causing consumers of decoded frames to rea...