CVE-2026-125190

FFmpeg versions through 9.0.2 are vulnerable to an information disclosure flaw in the decode_mvc2() function located in libavcodec/mvcdec.c. The vulnerability stems from unchecked palette indices , where a crafted MVC2 stream can declare a small number of colors but reference higher indices. This...