EUVD-2026-120216

FFmpeg through 9.0.2 contains an uninitialized stack memory disclosure vulnerability in oldcodec23 of libavcodec/sanm.c that leaks stack bytes into decoded frames. Attackers can supply a crafted LucasArts SMUSH/SANM animation using codec 23 with an inline table to expose decoder process stack...

CVE-2026-125266

FFmpeg versions through 9.0.2 are vulnerable to an uninitialized stack memory disclosure in the old_codec23() function located in libavcodec/sanm.c. An attacker can exploit this by providing a crafted LucasArts SMUSH/SANM animation using codec 23 with an inline table. This causes the decoder to l...