Who is not affected by CVE-2026-125181?

Q: Who is not affected by CVE-2026-125181?

Not affected if: arm64, little-endian, little-endian-build, no-flic-decoding, trusted-input-only, x86.

HIGH7.3CVSS · disclosure@vulncheck.com

NO KNOWN
EXPLOIT

FFMPEG · CVE-2026-125181 · Package

FFmpeg: crafted FLIC file corrupts heap memory on big-endian builds

NO FIX YET

FFmpeg's FLIC video decoder writes past the end of a frame buffer when it reads a crafted 15/16 bpp FLI_BRUN chunk on big-endian builds. An attacker who supplies such a file can corrupt heap memory and crash the process.

first public Nov 9, 2026 · 2 sources

Could this affect your app?

Free first check from your website. Connect your repo for the full answer.

01 · Who is affected

Only FFmpeg builds on big-endian CPUs (such as s390x) that decode untrusted FLIC/FLX files are exposed; a crafted 15/16 bpp FLI_BRUN chunk makes the decoder write past the frame buffer and crash the process. Little-endian systems (x86-64, most arm64) can skip it. The advisory rates it local with user interaction (CVSS 4.0 7.3).

ffmpeg<= 9.0.2 (big-endian builds only)

Not affected if arm64, little-endian, little-endian-build, no-flic-decoding, trusted-input-only, x86

Who cares big-endian, ffmpeg, libavcodec, media-processing, powerpc, s390x

02 · How to check

Little-endian hosts (x86-64, typical arm64) are not affected
On big-endian hosts (s390x, some PowerPC/MIPS), run ffmpeg -version; versions up to 9.0.2 are affected unless built from source containing commit c0d308a9a616f4abcc4e0a4d86f7de92ecdef9f6 (also check distro backports)
Check whether pipelines decode untrusted FLIC/FLX (15/16 bpp) files with ffmpeg/libavcodec

03 · The fix

No fix yet, per the sources.

Exploited: No reports yet
Public exploit: None on GitHub
EPSS: Not scored
Last updated: Nov 9, 2026

How it unfolded

2 events · Nov 9, 2026 → Nov 9, 2026

Nov 9, 202619:28 UTCNVD CVE-2026-125181
Nov 9, 202619:34 UTCInfraStack Analyst Read vulncheck advisory and commit c0d308a (via WebFetch; web-cli Exa out of credits). Affected FFmpeg <= 9.0.2, big-endian only (reproduced on s390x/qemu); fix is a one-line change in flicvideo.c FLI_BRUN swap (reads decoded pixels, not packet). No fixed release named in sources; fix left unknown, nothing marked verified. Commit message says out-of-array read, advisory says OOB write. No exploitation or PoC seen. Did not search X/HN.moreless

What the sources say, verbatim

378 characters

FFmpeg through 9.0.2 contains an out-of-bounds write vulnerability in flic_decode_frame_15_16BPP() in libavcodec/flicvideo.c that allows attackers to corrupt heap memory on big-endian builds. Attackers can supply a crafted 15/16 bpp FLIC/FLX file with an FLI_BRUN chunk whose non-terminating byte-swap loop writes packet-derived data past the frame buffer, crashing the process.

Sources and references

Are you affected?

Tell InfraStack what you run. It checks this one, and every next one, against your stack.

Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.

InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.

In Slack

Run the check

Get the next Ffmpeg threat the day it hits your stack.

Start free

Post Share

HIGH7.3CVSS · disclosure@vulncheck.com

NO KNOWN
EXPLOIT

FFMPEG · CVE-2026-125181 · Package

FFmpeg: crafted FLIC file corrupts heap memory on big-endian builds

NO FIX YET

first public Nov 9, 2026 · 2 sources

Could this affect your app?

Free first check from your website. Connect your repo for the full answer.

01 · Who is affected

ffmpeg<= 9.0.2 (big-endian builds only)

Not affected if arm64, little-endian, little-endian-build, no-flic-decoding, trusted-input-only, x86

Who cares big-endian, ffmpeg, libavcodec, media-processing, powerpc, s390x

02 · How to check

Little-endian hosts (x86-64, typical arm64) are not affected
On big-endian hosts (s390x, some PowerPC/MIPS), run ffmpeg -version; versions up to 9.0.2 are affected unless built from source containing commit c0d308a9a616f4abcc4e0a4d86f7de92ecdef9f6 (also check distro backports)
Check whether pipelines decode untrusted FLIC/FLX (15/16 bpp) files with ffmpeg/libavcodec

03 · The fix

No fix yet, per the sources.

Exploited: No reports yet
Public exploit: None on GitHub
EPSS: Not scored
Last updated: Nov 9, 2026

How it unfolded

2 events · Nov 9, 2026 → Nov 9, 2026

Nov 9, 202619:28 UTCNVD CVE-2026-125181
Nov 9, 202619:34 UTCInfraStack Analyst Read vulncheck advisory and commit c0d308a (via WebFetch; web-cli Exa out of credits). Affected FFmpeg <= 9.0.2, big-endian only (reproduced on s390x/qemu); fix is a one-line change in flicvideo.c FLI_BRUN swap (reads decoded pixels, not packet). No fixed release named in sources; fix left unknown, nothing marked verified. Commit message says out-of-array read, advisory says OOB write. No exploitation or PoC seen. Did not search X/HN.moreless

What the sources say, verbatim

378 characters

Sources and references

Are you affected?

Tell InfraStack what you run. It checks this one, and every next one, against your stack.

Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.

InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.

In Slack

Run the check

Get the next Ffmpeg threat the day it hits your stack.

Start free

FFmpeg: crafted FLIC file corrupts heap memory on big-endian builds

01 · Who is affected

02 · How to check

03 · The fix

How it unfolded

What the sources say, verbatim

Sources and references

Read next

Get the next Ffmpeg threat the day it hits your stack.

FFmpeg: crafted FLIC file corrupts heap memory on big-endian builds

01 · Who is affected

02 · How to check

03 · The fix

How it unfolded

What the sources say, verbatim

Sources and references

Read next

Get the next Ffmpeg threat the day it hits your stack.