CVE-2026-125098: FFmpeg: FFmpeg through 9.0.2 contains an information disclosure vulnerability in vp8_lossy_decode_alpha() in libavcodec/webp.c…

FFmpeg through 9.0.2 contains an information disclosure vulnerability in vp8lossydecodealpha in libavcodec/webp.c that leaves alpha plane memory uninitialized for short uncompressed ALPH chunks. Attackers can supply a crafted WebP image whose ALPH chunk is shorter than width height to disclose...