FFMPEG · CVE-2026-125241 · Package
NO FIX YET · SEE WHAT TO DO
FFmpeg's FLIC video decoder in libavcodec/flicvideo.c fails to bounds-check pixel writes when frames use a negative stride. A crafted FLIC file can write past frame storage, corrupting heap memory to crash the application or possibly run code.
first public Nov 9, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications that decode FLIC files through FFmpeg's libavcodec, up to and including 9.0.2, especially services that process user-uploaded media (thumbnailing, transcoding). The attack needs a crafted FLIC file to be opened, and the CVSS vector marks it local with user interaction. Systems that never feed untrusted files to FFmpeg, or build without the flic decoder, can skip it.
Not affected if no-untrusted-flic-input
Who cares ffmpeg, libavcodec, media-processing
ffmpeg -version; versions up to and including 9.0.2 are in the stated range.ldd, dependency lists).git merge-base --is-ancestor 27f612b306eb04f81138173f705df9a9b055b01d HEAD).ffmpeg -decoders | grep -i flic); if absent you are not reached.FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in libavcodec/flicvideo.c that allows attackers to write out of bounds because check_pixel_ptr() checks only one bound with negative-stride frames. Attackers can supply a crafted FLIC file whose RLE and delta chunks write pixel data past frame storage, corrupting heap memory to crash applications or possibly execute code.
This page as .md · .json · CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.