Linux Distros Unpatched Vulnerability : CVE-2026-125101

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FFmpeg through 9.0.2 contains an information disclosure vulnerability in the VMnc decoder in libavcodec/vmnc.c that restores an unwritten cursor save area into...

Linux Distros Unpatched Vulnerability : CVE-2026-125195

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in adpcmencodeframe in libavcodec/adpcmenc.c that leaks heap bytes when encoding...

UBUNTU-CVE-2026-125101

FFmpeg through 9.0.2 contains an information disclosure vulnerability in the VMnc decoder in libavcodec/vmnc.c that restores an unwritten cursor save area into later frames. Attackers can supply a crafted VMnc stream where a frame fails after loading a cursor shape, causing uninitialized heap byt...

UBUNTU-CVE-2026-125103

FFmpeg through 9.0.2 contains an information disclosure vulnerability in ffmlzdecompression in libavcodec/mlz.c, which accepts string codes beyond the dictionary's next free code. Attackers can supply a crafted MPEG-4 ALS file with malformed initial or out-of-range codes to copy uninitialized hea...

CVE-2026-125177

FFmpeg through 9.0.2 contains an information disclosure vulnerability in the MSCC/SRGC decoder in libavcodec/mscc.c that outputs uninitialized heap bytes when RLE data ends early. Attackers can craft an MSCC or SRGC stream, such as in AVI, whose RLE data terminates early so the decoded frame...

CVE-2026-125103

FFmpeg through 9.0.2 contains an information disclosure vulnerability in ffmlzdecompression in libavcodec/mlz.c, which accepts string codes beyond the dictionary's next free code. Attackers can supply a crafted MPEG-4 ALS file with malformed initial or out-of-range codes to copy uninitialized hea...

CVE-2026-125101

FFmpeg through 9.0.2 contains an information disclosure vulnerability in the VMnc decoder in libavcodec/vmnc.c that restores an unwritten cursor save area into later frames. Attackers can supply a crafted VMnc stream where a frame fails after loading a cursor shape, causing uninitialized heap byt...

EUVD-2026-120266

FFmpeg through 9.0.2 contains an information disclosure vulnerability in the MSCC/SRGC decoder in libavcodec/mscc.c that outputs uninitialized heap bytes when RLE data ends early. Attackers can craft an MSCC or SRGC stream, such as in AVI, whose RLE data terminates early so the decoded frame...

CVE-2026-125103

FFmpeg versions through 9.0.2 are vulnerable to an information disclosure vulnerability within the ff_mlz_decompression() function in libavcodec/mlz.c. The root cause is the acceptance of string codes that exceed the dictionary's next free code. An attacker can provide a crafted MPEG-4 ALS file c...

CVE-2026-125101

FFmpeg versions through 9.0.2 are affected by an information disclosure vulnerability within the VMnc decoder located in libavcodec/vmnc.c. The root cause is the restoration of an unwritten cursor save area into subsequent frames. By providing a crafted VMnc stream where a frame fails after loadi...

EUVD-2026-120255

FFmpeg through 9.0.2 contains an information disclosure vulnerability in the VMnc decoder in libavcodec/vmnc.c that restores an unwritten cursor save area into later frames. Attackers can supply a crafted VMnc stream where a frame fails after loading a cursor shape, causing uninitialized heap byt...

PT-2026-140994

FFmpeg through 9.0.2 contains an information disclosure vulnerability in the VMnc decoder in libavcodec/vmnc.c that restores an unwritten cursor save area into later frames. Attackers can supply a crafted VMnc stream where a frame fails after loading a cursor shape, causing uninitialized heap byt...

PT-2026-140996

Name of the Vulnerable Software and Affected Versions FFmpeg versions prior to 9.0.3 Description An information disclosure issue exists in the ff mlz decompression function within libavcodec/mlz.c. The function accepts string codes that exceed the dictionary's next free code. A remote attacker ca...

CVE-2026-125101: FFmpeg: FFmpeg through 9.0.2 contains an information disclosure vulnerability in the VMnc decoder in libavcodec/vmnc.c that…

FFmpeg through 9.0.2 contains an information disclosure vulnerability in the VMnc decoder in libavcodec/vmnc.c that restores an unwritten cursor save area into later frames. Attackers can supply a crafted VMnc stream where a frame fails after loading a cursor shape, causing uninitialized heap byt...

CVE-2026-125177: FFmpeg: FFmpeg through 9.0.2 contains an information disclosure vulnerability in the MSCC/SRGC decoder in libavcodec/mscc.c…

FFmpeg through 9.0.2 contains an information disclosure vulnerability in the MSCC/SRGC decoder in libavcodec/mscc.c that outputs uninitialized heap bytes when RLE data ends early. Attackers can craft an MSCC or SRGC stream, such as in AVI, whose RLE data terminates early so the decoded frame...

PT-2026-141005

FFmpeg through 9.0.2 contains an information disclosure vulnerability in the MSCC/SRGC decoder in libavcodec/mscc.c that outputs uninitialized heap bytes when RLE data ends early. Attackers can craft an MSCC or SRGC stream, such as in AVI, whose RLE data terminates early so the decoded frame...

CVE-2026-125103: FFmpeg: FFmpeg through 9.0.2 contains an information disclosure vulnerability in ff_mlz_decompression() in libavcodec/mlz.c,…

FFmpeg through 9.0.2 contains an information disclosure vulnerability in ffmlzdecompression in libavcodec/mlz.c, which accepts string codes beyond the dictionary's next free code. Attackers can supply a crafted MPEG-4 ALS file with malformed initial or out-of-range codes to copy uninitialized hea...

CVE-2026-116732 libdwarf through 2.3.3 Heap Out-of-Bounds Read via dwarf_debug_addr_table

libdwarf through 2.3.3 contains a heap out-of-bounds read vulnerability in dwarfdebugaddrtable that omits the table starting offset when validating .debugaddr unit length. Attackers can supply a crafted object file with a non-zero offset table, causing dwarfdebugaddrbyindex to read past the heap...

Linux Distros Unpatched Vulnerability : CVE-2026-111146

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ytnef through 2.1.2 contains a heap out-of-bounds read vulnerability in MAPIPrint that allows attackers to read past heap allocations by supplying compressed RT...

CVE-2026-111162

WildMIDI through 0.5.0 contains a heap out-of-bounds read vulnerability in the HMP parser WMParseNewHmp that allows attackers to read beyond buffers via underflowed chunk lengths. Attackers can supply a crafted .hmp file with a chunk length of 0-12 that wraps to roughly 4 GB, crashing application...