CVE-2026-125171
Discovered by AISLEPUBLISHEDCWE-125
Description
FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in the Musepack SV7 decoder because mpc7_decode_init() does not validate lastframelen against MPC_FRAME_SIZE. Attackers can supply a crafted Musepack SV7 file declaring an oversized final frame, causing consumers of decoded frames to read past the audio buffer, leading to crashes or heap memory disclosure.
CVSS Base Scores
CVSS v4.06.9
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS v3.1
6.1CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
Affected Products
| Vendor | Product | Version | Status |
|---|---|---|---|
| FFmpeg | FFmpeg | 0 | affected |
Credits
- zhang xingxing(finder)
- Joshua Rogers (AISLE Research)(reporter)
- zhang xingxing(remediation developer)
References
- https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25074
- https://github.com/FFmpeg/FFmpeg/commit/5d59b7c45d7142bddd13ddc8891e72c5c7dc991b
- https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/mpc7.c#L281
- https://github.com/FFmpeg/FFmpeg
- https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-out-of-bounds-read-in-musepack-sv7-decoder-via-mpc7-c