{"id":"CVE-2026-125241","kind":"vulnerability","aliases":["CVE-2026-125241"],"related":[],"title":"FFmpeg: crafted FLIC file overflows heap memory in video decoder","description":"FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in libavcodec/flicvideo.c that allows attackers to write out of bounds because check_pixel_ptr() checks only one bound with negative-stride frames. Attackers can supply a crafted FLIC file whose RLE and delta chunks write pixel data past frame storage, corrupting heap memory to crash applications or possibly execute code.","summary":"FFmpeg's FLIC video decoder in libavcodec/flicvideo.c fails to bounds-check pixel writes when frames use a negative stride. A crafted FLIC file can write past frame storage, corrupting heap memory to crash the application or possibly run code.","severity":"high","cvss":7.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ffmpeg","fixed":[],"affected":"<= 9.0.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["ffmpeg","libavcodec","media-processing","package"],"not_affected_if":["no-untrusted-flic-input"],"how_to_check":"- Run `ffmpeg -version`; versions up to and including 9.0.2 are in the stated range.\n- Find where libavcodec is linked (`ldd`, dependency lists).\n- Check whether your tree contains commit 27f612b (`git merge-base --is-ancestor 27f612b306eb04f81138173f705df9a9b055b01d HEAD`).\n- Also check if you disabled the flic decoder at build time (`ffmpeg -decoders | grep -i flic`); if absent you are not reached.","fix":"Fixed upstream in commit 27f612b306eb04f81138173f705df9a9b055b01d (master). No release containing it is named in the sources read; until one ships, build from a tree with that commit or take your distro's backport.","status":"open","published_at":"2026-11-09T19:17:02+00:00","first_seen_at":"2026-11-09T19:28:20+00:00","triaged_at":"2026-11-09T19:29:54+00:00","updated_at":"2026-11-09T19:31:37+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-09T19:29:54Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"FFmpeg: crafted FLIC file overflows heap memory in video decoder","impact":"high","summary":"FFmpeg's FLIC video decoder in libavcodec/flicvideo.c fails to bounds-check pixel writes when frames use a negative stride. A crafted FLIC file can write past frame storage, corrupting heap memory to crash the application or possibly run code.","audience":"businesses","category":"package","nicknames":[],"who_cares":["ffmpeg","libavcodec","media-processing"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Application crashes or attacker may execute code via heap corruption","analyst_note":"Find the fixed FFmpeg version and the upstream patch (linked fix at github.com) and confirm the affected range and whether FLIC decoding is on by default.","how_to_check":"- Check the installed FFmpeg version with `ffmpeg -version`, and compare it with the ranges in the NVD entry (through 9.0.2)\n- Find where FFmpeg or libavcodec is linked into your applications, for example with `ldd` on Linux or by searching dependencies for `libavcodec`\n- unknown whether the sources list a specific setting to check","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-untrusted-flic-input"],"who_is_affected":"Applications that decode FLIC files with FFmpeg's libavcodec are exposed, most often when they accept user-supplied media. Systems that never decode FLIC input from untrusted sources are less likely to be reached. The sources do not name a fixed version.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000778,"input_tokens":4642,"output_tokens":628,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the fixed FFmpeg version and the upstream patch (linked fix at github.com) and confirm the affected range and whether FLIC decoding is on by default.","search":"'-125241':13A,16A '-2026':12A,15A '9.0.2':66C 'allow':76C 'applic':59B,119C 'attack':77C,96C 'bound':34B,82C,90C 'bounds-check':33B 'buffer':70C 'check':35B,84C,87C 'chunk':107C 'code':63B,123C 'contain':67C 'corrupt':53B,114C 'craft':2A,45B,100C 'crash':57B,118C 'cve':11A,14A 'data':110C 'decod':10A,28B 'delta':106C 'execut':122C 'fail':31B 'ffmpeg':1A,17A,18B,24B,64C 'file':4A,47B,102C 'flic':3A,26B,46B,101C 'frame':39B,51B,95C,112C 'heap':6A,54B,69C,115C 'libavcodec':19B 'libavcodec/flicvideo.c':30B,74C 'media':21B 'media-process':20B 'memori':7A,55B,116C 'negat':42B,93C 'negative-strid':92C 'one':89C 'overflow':5A,71C 'packag':23B 'past':50B,111C 'pixel':36B,85C,109C 'possibl':61B,121C 'process':22B 'ptr':86C 'rle':104C 'run':62B 'storag':52B,113C 'stride':43B,94C 'suppli':98C 'use':40B 'video':9A,27B 'vulner':72C 'whose':103C 'write':37B,49B,79C,108C","nicknames":[],"mitigations":[],"who_affected":"Applications that decode FLIC files through FFmpeg's libavcodec, up to and including 9.0.2, especially services that process user-uploaded media (thumbnailing, transcoding). The attack needs a crafted FLIC file to be opened, and the CVSS vector marks it local with user interaction. Systems that never feed untrusted files to FFmpeg, or build without the flic decoder, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["ffmpeg"],"ptokens":["ffmpeg"],"labels":["ffmpeg","high","libavcodec","mediaprocessing","package"],"campaign_type":null,"search_a":"'-125241':13A,16A '-2026':12A,15A 'craft':2A 'cve':11A,14A 'decod':10A 'ffmpeg':1A,17A 'file':4A 'flic':3A 'heap':6A 'memori':7A 'overflow':5A 'video':9A","search_b":"'applic':59B 'bound':34B 'bounds-check':33B 'check':35B 'code':63B 'corrupt':53B 'craft':45B 'crash':57B 'decod':28B 'fail':31B 'ffmpeg':18B,24B 'file':47B 'flic':26B,46B 'frame':39B,51B 'heap':54B 'libavcodec':19B 'libavcodec/flicvideo.c':30B 'media':21B 'media-process':20B 'memori':55B 'negat':42B 'packag':23B 'past':50B 'pixel':36B 'possibl':61B 'process':22B 'run':62B 'storag':52B 'stride':43B 'use':40B 'video':27B 'write':37B,49B","search_c":"'9.0.2':66C 'allow':76C 'applic':119C 'attack':77C,96C 'bound':82C,90C 'buffer':70C 'check':84C,87C 'chunk':107C 'code':123C 'contain':67C 'corrupt':114C 'craft':100C 'crash':118C 'data':110C 'delta':106C 'execut':122C 'ffmpeg':64C 'file':102C 'flic':101C 'frame':95C,112C 'heap':69C,115C 'libavcodec/flicvideo.c':74C 'memori':116C 'negat':93C 'negative-strid':92C 'one':89C 'overflow':71C 'past':111C 'pixel':85C,109C 'possibl':121C 'ptr':86C 'rle':104C 'storag':113C 'stride':94C 'suppli':98C 'vulner':72C 'whose':103C 'write':79C,108C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T19:17:02+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125241","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125241","severity":null,"published_at":"2026-11-09T19:17:02+00:00","modified_at":"2026-11-09T19:17:02+00:00","first_seen_at":"2026-11-09T19:28:20+00:00","fetched_at":"2026-11-09T19:28:20+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-125241:2321","url":null,"severity":null,"published_at":"2026-11-09T19:31:37+00:00","modified_at":"2026-11-09T19:31:37+00:00","first_seen_at":"2026-11-09T19:31:37+00:00","fetched_at":"2026-11-09T19:31:37+00:00","note":"Read upstream commit 27f612b (flicvideo.c, bounds both ends via pixel_range(); found by Joshua Rogers/AISLE) and VulnCheck advisory. Neither names a fixed release; affected 'through 9.0.2'. Default-build status of FLIC decoder not confirmed from a source. Exa credits exhausted, no social search done."}],"documents":[{"id":109371,"url":"https://github.com/FFmpeg/FFmpeg/commit/27f612b306eb04f81138173f705df9a9b055b01d","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109372,"url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-heap-buffer-overflow-via-flic-decoder-check-pixel-ptr","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}