{"id":"CVE-2026-125181","kind":"vulnerability","aliases":["CVE-2026-125181"],"related":[],"title":"FFmpeg: crafted FLIC file corrupts heap memory on big-endian builds","description":"FFmpeg through 9.0.2 contains an out-of-bounds write vulnerability in flic_decode_frame_15_16BPP() in libavcodec/flicvideo.c that allows attackers to corrupt heap memory on big-endian builds. Attackers can supply a crafted 15/16 bpp FLIC/FLX file with an FLI_BRUN chunk whose non-terminating byte-swap loop writes packet-derived data past the frame buffer, crashing the process.","summary":"FFmpeg's FLIC video decoder writes past the end of a frame buffer when it reads a crafted 15/16 bpp FLI_BRUN chunk on big-endian builds. An attacker who supplies such a file can corrupt heap memory and crash the process.","severity":"high","cvss":7.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ffmpeg","fixed":[],"affected":"<= 9.0.2 (big-endian builds only)","ecosystem":"vendor"}],"ecosystems":[],"tags":["big-endian","ffmpeg","libavcodec","media-processing","package","powerpc","s390x"],"not_affected_if":["arm64","little-endian","little-endian-build","no-flic-decoding","trusted-input-only","x86"],"how_to_check":"Little-endian hosts (x86-64, typical arm64) are not affected. On big-endian hosts (s390x, some PowerPC/MIPS), run 'ffmpeg -version'; versions up to 9.0.2 are affected unless built from source containing commit c0d308a9a616f4abcc4e0a4d86f7de92ecdef9f6 (also check distro backports). Check whether pipelines decode untrusted FLIC/FLX (15/16 bpp) files with ffmpeg/libavcodec.","fix":null,"status":"open","published_at":"2026-11-09T19:16:53+00:00","first_seen_at":"2026-11-09T19:28:17+00:00","triaged_at":"2026-11-09T19:30:14+00:00","updated_at":"2026-11-09T19:34:56+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-09T19:30:14Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"FFmpeg: crafted FLIC file corrupts heap memory on big-endian builds","impact":"medium","summary":"FFmpeg's FLIC video decoder writes past the end of a frame buffer when it reads a crafted 15/16 bpp FLI_BRUN chunk on big-endian builds. An attacker who supplies such a file can corrupt heap memory and crash the process.","audience":"developers","category":"package","nicknames":[],"who_cares":["ffmpeg","libavcodec","big-endian","media-processing"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"heap memory corruption crashes the process, possibly more","analyst_note":"Confirm the fixed FFmpeg version and the exact big-endian requirement from the linked patch commits and the vulncheck advisory.","how_to_check":"- Run `ffmpeg -version` and compare against the fixed release in the sources.\n- Check whether the build is big-endian (for example, on PowerPC or s390x hosts).\n- Look for FLIC/FLX file decoding in your pipelines (ffmpeg or libavcodec used on untrusted input).","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["little-endian-build","no-flic-decoding","trusted-input-only"],"who_is_affected":"Systems that decode FLIC/FLX files with FFmpeg's libavcodec, especially when the input is untrusted and the build targets big-endian hardware. Little-endian builds and pipelines that never decode FLIC input are less exposed. The sources do not say which exact versions are fixed beyond 'through 9.0.2'.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000788,"input_tokens":4685,"output_tokens":639,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed FFmpeg version and the exact big-endian requirement from the linked patch commits and the vulncheck advisory.","search":"'-125181':15A,18A '-2026':14A,17A '15':89C '15/16':49B,110C '16bpp':90C '9.0.2':76C 'allow':94C 'attack':60B,95C,105C 'big':10A,21B,56B,102C 'big-endian':9A,20B,55B,101C 'bound':82C 'bpp':50B,111C 'brun':52B,117C 'buffer':43B,135C 'build':12A,58B,104C 'byte':124C 'byte-swap':123C 'chunk':53B,118C 'contain':77C 'corrupt':5A,67B,97C 'craft':2A,48B,109C 'crash':71B,136C 'cve':13A,16A 'data':131C 'decod':35B,87C 'deriv':130C 'end':39B 'endian':11A,22B,57B,103C 'ffmpeg':1A,19A,23B,31B,74C 'file':4A,65B,113C 'fli':51B,116C 'flic':3A,33B,86C 'flic/flx':112C 'frame':42B,88C,134C 'heap':6A,68B,98C 'libavcodec':24B 'libavcodec/flicvideo.c':92C 'loop':126C 'media':26B 'media-process':25B 'memori':7A,69B,99C 'non':121C 'non-termin':120C 'out-of-bound':79C 'packag':28B 'packet':129C 'packet-deriv':128C 'past':37B,132C 'powerpc':29B 'process':27B,73B,138C 'read':46B 's390x':30B 'suppli':62B,107C 'swap':125C 'termin':122C 'video':34B 'vulner':84C 'whose':119C 'write':36B,83C,127C","nicknames":[],"mitigations":[],"who_affected":"Only FFmpeg builds on big-endian CPUs (such as s390x) that decode untrusted FLIC/FLX files are exposed; a crafted 15/16 bpp FLI_BRUN chunk makes the decoder write past the frame buffer and crash the process. Little-endian systems (x86-64, most arm64) can skip it. The advisory rates it local with user interaction (CVSS 4.0 7.3).","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":["ffmpeg"],"ptokens":["ffmpeg"],"labels":["bigendian","ffmpeg","high","libavcodec","mediaprocessing","package","powerpc","s390x"],"campaign_type":null,"search_a":"'-125181':15A,18A '-2026':14A,17A 'big':10A 'big-endian':9A 'build':12A 'corrupt':5A 'craft':2A 'cve':13A,16A 'endian':11A 'ffmpeg':1A,19A 'file':4A 'flic':3A 'heap':6A 'memori':7A","search_b":"'15/16':49B 'attack':60B 'big':21B,56B 'big-endian':20B,55B 'bpp':50B 'brun':52B 'buffer':43B 'build':58B 'chunk':53B 'corrupt':67B 'craft':48B 'crash':71B 'decod':35B 'end':39B 'endian':22B,57B 'ffmpeg':23B,31B 'file':65B 'fli':51B 'flic':33B 'frame':42B 'heap':68B 'libavcodec':24B 'media':26B 'media-process':25B 'memori':69B 'packag':28B 'past':37B 'powerpc':29B 'process':27B,73B 'read':46B 's390x':30B 'suppli':62B 'video':34B 'write':36B","search_c":"'15':89C '15/16':110C '16bpp':90C '9.0.2':76C 'allow':94C 'attack':95C,105C 'big':102C 'big-endian':101C 'bound':82C 'bpp':111C 'brun':117C 'buffer':135C 'build':104C 'byte':124C 'byte-swap':123C 'chunk':118C 'contain':77C 'corrupt':97C 'craft':109C 'crash':136C 'data':131C 'decod':87C 'deriv':130C 'endian':103C 'ffmpeg':74C 'file':113C 'fli':116C 'flic':86C 'flic/flx':112C 'frame':88C,134C 'heap':98C 'libavcodec/flicvideo.c':92C 'loop':126C 'memori':99C 'non':121C 'non-termin':120C 'out-of-bound':79C 'packet':129C 'packet-deriv':128C 'past':132C 'process':138C 'suppli':107C 'swap':125C 'termin':122C 'vulner':84C 'whose':119C 'write':83C,127C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T19:16:53+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125181","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125181","severity":null,"published_at":"2026-11-09T19:16:53+00:00","modified_at":"2026-11-09T19:16:53+00:00","first_seen_at":"2026-11-09T19:28:17+00:00","fetched_at":"2026-11-09T19:28:17+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-125181:2334","url":null,"severity":null,"published_at":"2026-11-09T19:34:56+00:00","modified_at":"2026-11-09T19:34:56+00:00","first_seen_at":"2026-11-09T19:34:56+00:00","fetched_at":"2026-11-09T19:34:56+00:00","note":"Read vulncheck advisory and commit c0d308a (via WebFetch; web-cli Exa out of credits). Affected FFmpeg <= 9.0.2, big-endian only (reproduced on s390x/qemu); fix is a one-line change in flicvideo.c FLI_BRUN swap (reads decoded pixels, not packet). No fixed release named in sources; fix left unknown, nothing marked verified. Commit message says out-of-array read, advisory says OOB write. No exploitation or PoC seen. Did not search X/HN."}],"documents":[{"id":109250,"url":"https://github.com/FFmpeg/FFmpeg/commit/c0d308a9a616f4abcc4e0a4d86f7de92ecdef9f6","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109251,"url":"https://github.com/FFmpeg/FFmpeg/commit/eb47d7bb6cf13042c6ab14e22fc0c0c3a6e51e12","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109252,"url":"https://github.com/FFmpeg/FFmpeg/commit/ee30fb98c0d4e97abbd5e371d2a3a926e92bec70","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109253,"url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-flic-decoder-out-of-bounds-write-via-fli-brun-byte-swap","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}