CVE-2026-125197 · Package
NO FIX YET
FFmpeg's LCL video decoder miscalculates a length when a packet is shorter than 8 bytes, causing a heap out-of-bounds read. An attacker who supplies a crafted AVI or MKV file can crash the decoding application.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Systems that run FFmpeg or libavcodec to decode AVI or MKV files from untrusted sources, such as upload processing or media conversion services, are exposed. Systems that only process trusted local media, or do not use the LCL codec path, are less exposed. The sources do not name the affected version ranges beyond 'through 9.0.2'.
Not affected if trusted-input-only
Who cares ffmpeg, libavcodec, media-processing
ffmpeg -version, comparing it against the fixed versions in the product data.No fix yet, per the sources.
FFmpeg through 9.0.2 contains an integer underflow in decode_frame() in libavcodec/lcldec.c that allows attackers to trigger a heap out-of-bounds read via short ZLIB packets with FLAG_MULTITHREAD. Attackers can supply a crafted AVI or MKV file with an LCL video stream whose packet is shorter than 8 bytes, bypassing length clamping to crash the decoding application.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.