CVE-2026-125177

FFmpeg versions through 9.0.2 are vulnerable to an information disclosure vulnerability within the MSCC/SRGC decoder located in libavcodec/mscc.c. The root cause is the output of uninitialized heap bytes when RLE data terminates early. An attacker can craft a malicious MSCC or SRGC stream (e.g., ...