CVE-2026-125217
Received Received - Intake

Heap Data Leak in FFmpeg RoQ DPCM Encoding

Publication date: 2026-11-09

Last updated on: 2026-11-09

Assigner: VulnCheck

Description
FFmpeg through 9.0.2 contains an uninitialized memory use vulnerability in roq_dpcm_encode_frame() in libavcodec/roqaudioenc.c that encodes stale heap contents when flushed early. Attackers can supply short audio streams under eight frames for RoQ DPCM transcoding, causing DPCM-quantized uninitialized heap data from frame_buffer to leak into output packets.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-09
Last Modified
2026-11-09
Generated
2026-11-09
AI Q&A
2026-11-09
EPSS Evaluated
N/A
NVD
CVE-2026-125217
EUVD
EUVD-2026-120306

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
FFmpeg FFmpeg From 0 (inc) to 9.0.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-908 The product uses or accesses a resource that has not been initialized.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in FFmpeg through 9.0.2 involves uninitialized memory being used in the roq_dpcm_encode_frame() function. When audio streams shorter than eight frames are supplied for RoQ DPCM transcoding, stale heap data from frame_buffer is encoded into output packets, potentially leaking sensitive information.

Impact Analysis

An attacker could exploit this to access uninitialized memory contents, potentially revealing sensitive data such as passwords or encryption keys. This could affect systems using FFmpeg for audio transcoding, especially if processing short audio streams.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, violating confidentiality requirements in GDPR and HIPAA. Organizations processing audio data with FFmpeg may face compliance risks if sensitive information is leaked due to uninitialized memory use.

Mitigation Strategies

Update FFmpeg to version 9.0.3 or later to address the uninitialized memory use in roq_dpcm_encode_frame().

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-125217. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...