{"id":"CVE-2026-125197","kind":"vulnerability","aliases":["CVE-2026-125197"],"related":[],"title":"FFmpeg: crafted AVI or MKV file causes heap out-of-bounds read","description":"FFmpeg through 9.0.2 contains an integer underflow in decode_frame() in libavcodec/lcldec.c that allows attackers to trigger a heap out-of-bounds read via short ZLIB packets with FLAG_MULTITHREAD. Attackers can supply a crafted AVI or MKV file with an LCL video stream whose packet is shorter than 8 bytes, bypassing length clamping to crash the decoding application.","summary":"FFmpeg's LCL video decoder miscalculates a length when a packet is shorter than 8 bytes, causing a heap out-of-bounds read. An attacker who supplies a crafted AVI or MKV file can crash the decoding application.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ffmpeg","libavcodec","media-processing","package"],"not_affected_if":["trusted-input-only"],"how_to_check":"- Check the installed FFmpeg version with `ffmpeg -version`, comparing it against the fixed versions in the product data.\n- Look for applications that decode untrusted AVI or MKV files with FFmpeg or libavcodec.","fix":null,"status":"open","published_at":"2026-11-09T19:16:55+00:00","first_seen_at":"2026-11-09T19:28:18+00:00","triaged_at":"2026-11-09T19:30:18+00:00","updated_at":"2026-11-09T19:30:18+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-09T19:30:18Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"FFmpeg: crafted AVI or MKV file causes heap out-of-bounds read","impact":"low","summary":"FFmpeg's LCL video decoder miscalculates a length when a packet is shorter than 8 bytes, causing a heap out-of-bounds read. An attacker who supplies a crafted AVI or MKV file can crash the decoding application.","audience":"businesses","category":"package","nicknames":[],"who_cares":["ffmpeg","libavcodec","media-processing"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Decoding application crashes from a heap out-of-bounds read.","analyst_note":"Confirm the fixed FFmpeg version and the patch commit from the linked GitHub fix and the VulnCheck advisory; the signal gives only 'through 9.0.2'.","how_to_check":"- Check the installed FFmpeg version with `ffmpeg -version`, comparing it against the fixed versions in the product data.\n- Look for applications that decode untrusted AVI or MKV files with FFmpeg or libavcodec.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["trusted-input-only"],"who_is_affected":"Systems that run FFmpeg or libavcodec to decode AVI or MKV files from untrusted sources, such as upload processing or media conversion services, are exposed. Systems that only process trusted local media, or do not use the LCL codec path, are less exposed. The sources do not name the affected version ranges beyond 'through 9.0.2'.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000762,"input_tokens":4647,"output_tokens":594,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125197':16A,19A '-2026':15A,18A '8':40B,115C '9.0.2':67C 'allow':78C 'applic':64B,124C 'attack':51B,79C,96C 'avi':3A,56B,101C 'bound':12A,48B,87C 'bypass':117C 'byte':41B,116C 'caus':7A,42B 'clamp':119C 'contain':68C 'craft':2A,55B,100C 'crash':61B,121C 'cve':14A,17A 'decod':30B,63B,73C,123C 'ffmpeg':1A,20B,26B,65C 'file':6A,59B,104C 'flag':94C 'frame':74C 'heap':8A,44B,83C 'integ':70C 'lcl':28B,107C 'length':33B,118C 'libavcodec':21B 'libavcodec/lcldec.c':76C 'media':23B 'media-process':22B 'miscalcul':31B 'mkv':5A,58B,103C 'multithread':95C 'out-of-bound':9A,45B,84C 'packag':25B 'packet':36B,92C,111C 'process':24B 'read':13A,49B,88C 'short':90C 'shorter':38B,113C 'stream':109C 'suppli':53B,98C 'trigger':81C 'underflow':71C 'via':89C 'video':29B,108C 'whose':110C 'zlib':91C","nicknames":[],"mitigations":[],"who_affected":"Systems that run FFmpeg or libavcodec to decode AVI or MKV files from untrusted sources, such as upload processing or media conversion services, are exposed. Systems that only process trusted local media, or do not use the LCL codec path, are less exposed. The sources do not name the affected version ranges beyond 'through 9.0.2'.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ffmpeg","libavcodec","mediaprocessing","medium","package"],"campaign_type":null,"search_a":"'-125197':16A,19A '-2026':15A,18A 'avi':3A 'bound':12A 'caus':7A 'craft':2A 'cve':14A,17A 'ffmpeg':1A 'file':6A 'heap':8A 'mkv':5A 'out-of-bound':9A 'read':13A","search_b":"'8':40B 'applic':64B 'attack':51B 'avi':56B 'bound':48B 'byte':41B 'caus':42B 'craft':55B 'crash':61B 'decod':30B,63B 'ffmpeg':20B,26B 'file':59B 'heap':44B 'lcl':28B 'length':33B 'libavcodec':21B 'media':23B 'media-process':22B 'miscalcul':31B 'mkv':58B 'out-of-bound':45B 'packag':25B 'packet':36B 'process':24B 'read':49B 'shorter':38B 'suppli':53B 'video':29B","search_c":"'8':115C '9.0.2':67C 'allow':78C 'applic':124C 'attack':79C,96C 'avi':101C 'bound':87C 'bypass':117C 'byte':116C 'clamp':119C 'contain':68C 'craft':100C 'crash':121C 'decod':73C,123C 'ffmpeg':65C 'file':104C 'flag':94C 'frame':74C 'heap':83C 'integ':70C 'lcl':107C 'length':118C 'libavcodec/lcldec.c':76C 'mkv':103C 'multithread':95C 'out-of-bound':84C 'packet':92C,111C 'read':88C 'short':90C 'shorter':113C 'stream':109C 'suppli':98C 'trigger':81C 'underflow':71C 'via':89C 'video':108C 'whose':110C 'zlib':91C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T19:16:55+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125197","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125197","severity":null,"published_at":"2026-11-09T19:16:55+00:00","modified_at":"2026-11-09T19:16:55+00:00","first_seen_at":"2026-11-09T19:28:18+00:00","fetched_at":"2026-11-09T19:28:18+00:00","note":null}],"documents":[{"id":109285,"url":"https://github.com/FFmpeg/FFmpeg/commit/12e5d4ec98b7add7bcac9d8131d9a6dfb2549966","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109286,"url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-heap-out-of-bounds-read-via-lcl-zlib-multithread-decoding","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}