Use-of-Uninitialized-Value Vulnerability in mpv Package
Summary
OSV-2026-144: Use-of-uninitialized-value in initFilter. Affects mpv versions >= cc1e654286b9bbca2cd5428d658874205624723e, < d1743b641b5b8a51115a9828124c7a9b527115e3. Fixed in d1743b641b5b8a51115a9828124c7a9b527115e3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
mpv is a versatile media player that supports a wide range of video and audio formats. It is known for its high-quality playback and extensive feature set, including support for various codecs and streaming protocols. However, like many open-source projects, it can be susceptible to vulnerabilities that may affect its stability and security.
Vulnerability Detail
The vulnerability identified as a use-of-uninitialized-value in the initFilter function can lead to crashes during the initialization of the media player. This issue was reported through OSS-Fuzz, highlighting a specific crash state involving the ff_sws_init_single_context and mp_sws_reinit functions. If exploited, this vulnerability could cause unexpected behavior in the application, potentially leading to a denial of service.
How To Fix
Minimum fixed version
d1743b641b5b8a51115a9828124c7a9b527115e3
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is recommended to update to the patched version as soon as possible to mitigate the risk.
Conclusion
The use-of-uninitialized-value vulnerability in the mpv package poses a risk of application crashes and instability. It is crucial for users to update to the patched version to ensure the security and reliability of their media playback experience.
See every vulnerability recorded for mpv →
FAQ
The vulnerability is a use-of-uninitialized-value issue that can lead to application crashes.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Exploitation of this vulnerability could lead to unexpected application behavior, including crashes and denial of service.
Yes, a patch is available in the fixed version of the mpv package.
Update your mpv package to the fixed version as soon as possible to secure your application against this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for mpv.
