CVE-2026-125190

FFmpeg through 9.0.2 contains an information disclosure vulnerability in decodemvc2 in libavcodec/mvcdec.c that leaks uninitialized stack memory through unchecked palette indices. Attackers can supply a crafted MVC2 stream declaring few colors but referencing higher palette indices, copying proce...