CVE-2026-125103

FFmpeg through 9.0.2 contains an information disclosure vulnerability in ffmlzdecompression in libavcodec/mlz.c, which accepts string codes beyond the dictionary's next free code. Attackers can supply a crafted MPEG-4 ALS file with malformed initial or out-of-range codes to copy uninitialized hea...

CVE-2026-125103 FFmpeg through 9.0.2 Uninitialized Heap Disclosure via MLZ Decompressor in ALS Decoder

FFmpeg through 9.0.2 contains an information disclosure vulnerability in ffmlzdecompression in libavcodec/mlz.c, which accepts string codes beyond the dictionary's next free code. Attackers can supply a crafted MPEG-4 ALS file with malformed initial or out-of-range codes to copy uninitialized hea...

EUVD-2026-120257

FFmpeg through 9.0.2 contains an information disclosure vulnerability in ffmlzdecompression in libavcodec/mlz.c, which accepts string codes beyond the dictionary's next free code. Attackers can supply a crafted MPEG-4 ALS file with malformed initial or out-of-range codes to copy uninitialized hea...

CVE-2026-125103 FFmpeg through 9.0.2 Uninitialized Heap Disclosure via MLZ Decompressor in ALS Decoder

FFmpeg through 9.0.2 contains an information disclosure vulnerability in ffmlzdecompression in libavcodec/mlz.c, which accepts string codes beyond the dictionary's next free code. Attackers can supply a crafted MPEG-4 ALS file with malformed initial or out-of-range codes to copy uninitialized hea...

CVE-2026-125103

FFmpeg versions through 9.0.2 are vulnerable to an information disclosure vulnerability within the ff_mlz_decompression() function in libavcodec/mlz.c. The root cause is the acceptance of string codes that exceed the dictionary's next free code. An attacker can provide a crafted MPEG-4 ALS file c...

PT-2026-140996

FFmpeg through 9.0.2 contains an information disclosure vulnerability in ff mlz decompression in libavcodec/mlz.c, which accepts string codes beyond the dictionary's next free code. Attackers can supply a crafted MPEG-4 ALS file with malformed initial or out-of-range codes to copy uninitialized...

CVE-2026-125103: FFmpeg: FFmpeg through 9.0.2 contains an information disclosure vulnerability in ff_mlz_decompression() in libavcodec/mlz.c,…

FFmpeg through 9.0.2 contains an information disclosure vulnerability in ffmlzdecompression in libavcodec/mlz.c, which accepts string codes beyond the dictionary's next free code. Attackers can supply a crafted MPEG-4 ALS file with malformed initial or out-of-range codes to copy uninitialized hea...