{"id":"CVE-2026-125262","kind":"vulnerability","aliases":["CVE-2026-125262"],"related":[],"title":"FFmpeg: crafted LCEVC data in video streams overflows heap memory","description":"FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in libavcodec/lcevcdec.c because LCEVC output picture dimensions are not validated against the allocated frame. Attackers can embed crafted LCEVC enhancement data with differing global configurations in H.264 or HEVC streams to corrupt heap memory in decoding applications.","summary":"FFmpeg through 9.0.2 fails to check LCEVC output picture dimensions against the allocated frame in libavcodec/lcevcdec.c. A crafted H.264 or HEVC stream carrying LCEVC enhancement data can corrupt heap memory in a decoding application.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ffmpeg","fixed":[],"affected":">= 7.1, <= 9.0.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["ffmpeg","lcevc","libavcodec","runtime","video-processing"],"not_affected_if":["no-liblcevc-dec","trusted-input-only"],"how_to_check":"- Run ffmpeg -version and look for --enable-liblcevc-dec in the configuration line (inferred from the commit touching lcevc_dec in configure; the sources do not say this outright). If it is absent, the LCEVC code path is probably not built in.\n- If it is present and the version is 7.1 through 9.0.2 without commit fd6dfa6, you are in range, and any service that decodes untrusted H.264 or HEVC video is exposed.\n- Also check distro or vendor FFmpeg packages and apps that bundle libavcodec.","fix":"No fixed release is named in the sources. The fix is upstream commit fd6dfa613a48665dcb8d14186b33dad90aa40ae0 (avcodec/lcevcdec: check the picture LCEVCdec will output against the one allocated), which also raises the required lcevc_dec library to 4.2.0. Use a build that includes that commit; check FFmpeg's release page for the first release that does.","status":"open","published_at":"2026-11-09T20:18:12+00:00","first_seen_at":"2026-11-09T20:48:13+00:00","triaged_at":"2026-11-09T20:49:39+00:00","updated_at":"2026-11-09T20:51:01+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-09T20:49:39Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"FFmpeg: crafted LCEVC data in video streams overflows heap memory","impact":"high","summary":"FFmpeg through 9.0.2 fails to check LCEVC output picture dimensions against the allocated frame in libavcodec/lcevcdec.c. A crafted H.264 or HEVC stream carrying LCEVC enhancement data can corrupt heap memory in a decoding application.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["ffmpeg","libavcodec","video-processing"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"heap corruption in a decoding application, possibly code execution","analyst_note":"Confirm the fixed FFmpeg version and whether LCEVC decoding is enabled by default, using the linked patch at github.com and the VulnCheck advisory.","how_to_check":"- Run `ffmpeg -version` and compare against the fixed release in the vendor ranges (unknown in the sources)\n- Check whether your application or service decodes untrusted H.264 or HEVC video with LCEVC enhancement data (unknown in the sources)","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["trusted-input-only"],"who_is_affected":"Applications and services that decode H.264 or HEVC streams using FFmpeg's libavcodec, especially those accepting uploaded or third-party video. Systems that only process trusted local media or do not use the LCEVC decoding path are less exposed. The sources do not state the exact affected build flags or default configuration.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000762,"input_tokens":4627,"output_tokens":598,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed FFmpeg version and whether LCEVC decoding is enabled by default, using the linked patch at github.com and the VulnCheck advisory.","search":"'-125262':13A,16A '-2026':12A,15A '9.0.2':27B,61C 'alloc':37B,80C 'applic':58B,104C 'attack':82C 'buffer':65C 'carri':47B 'check':30B 'configur':92C 'contain':62C 'corrupt':52B,99C 'craft':2A,42B,85C 'cve':11A,14A 'data':4A,50B,88C 'decod':57B,103C 'differ':90C 'dimens':34B,74C 'emb':84C 'enhanc':49B,87C 'fail':28B 'ffmpeg':1A,17A,18B,25B,59C 'frame':38B,81C 'global':91C 'h.264':43B,94C 'heap':9A,53B,64C,100C 'hevc':45B,96C 'lcevc':3A,19B,31B,48B,71C,86C 'libavcodec':20B 'libavcodec/lcevcdec.c':40B,69C 'memori':10A,54B,101C 'output':32B,72C 'overflow':8A,66C 'pictur':33B,73C 'process':24B 'runtim':21B 'stream':7A,46B,97C 'valid':77C 'video':6A,23B 'video-process':22B 'vulner':67C","nicknames":[],"mitigations":[],"who_affected":"FFmpeg 7.1 through 9.0.2 (VulnCheck) builds that decode H.264 or HEVC video carrying LCEVC enhancement data, such as upload, transcoding or thumbnailing services handling untrusted video. The LCEVC path appears to need the optional lcevc_dec library; builds without it are probably not affected, but the sources do not confirm the default. Systems that only handle trusted media can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["ffmpeg"],"ptokens":["ffmpeg"],"labels":["ffmpeg","high","lcevc","libavcodec","runtime","videoprocessing"],"campaign_type":null,"search_a":"'-125262':13A,16A '-2026':12A,15A 'craft':2A 'cve':11A,14A 'data':4A 'ffmpeg':1A,17A 'heap':9A 'lcevc':3A 'memori':10A 'overflow':8A 'stream':7A 'video':6A","search_b":"'9.0.2':27B 'alloc':37B 'applic':58B 'carri':47B 'check':30B 'corrupt':52B 'craft':42B 'data':50B 'decod':57B 'dimens':34B 'enhanc':49B 'fail':28B 'ffmpeg':18B,25B 'frame':38B 'h.264':43B 'heap':53B 'hevc':45B 'lcevc':19B,31B,48B 'libavcodec':20B 'libavcodec/lcevcdec.c':40B 'memori':54B 'output':32B 'pictur':33B 'process':24B 'runtim':21B 'stream':46B 'video':23B 'video-process':22B","search_c":"'9.0.2':61C 'alloc':80C 'applic':104C 'attack':82C 'buffer':65C 'configur':92C 'contain':62C 'corrupt':99C 'craft':85C 'data':88C 'decod':103C 'differ':90C 'dimens':74C 'emb':84C 'enhanc':87C 'ffmpeg':59C 'frame':81C 'global':91C 'h.264':94C 'heap':64C,100C 'hevc':96C 'lcevc':71C,86C 'libavcodec/lcevcdec.c':69C 'memori':101C 'output':72C 'overflow':66C 'pictur':73C 'stream':97C 'valid':77C 'vulner':67C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T20:18:12+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125262","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125262","severity":null,"published_at":"2026-11-09T20:18:12+00:00","modified_at":"2026-11-09T20:18:12+00:00","first_seen_at":"2026-11-09T20:48:13+00:00","fetched_at":"2026-11-09T20:48:13+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-125262:2344","url":null,"severity":null,"published_at":"2026-11-09T20:51:01+00:00","modified_at":"2026-11-09T20:51:01+00:00","first_seen_at":"2026-11-09T20:51:01+00:00","fetched_at":"2026-11-09T20:51:01+00:00","note":"Read the FFmpeg commit fd6dfa6 (fix) and VulnCheck advisory (third-party). Affected >=7.1,<=9.0.2 per VulnCheck; no fixed release named in either. web-cli out of Exa credits, used WebFetch. Default enablement not stated; commit bumps configure's lcevc_dec requirement to 4.2.0, which implies an optional external library build."}],"documents":[{"id":109735,"url":"https://github.com/FFmpeg/FFmpeg/commit/fd6dfa613a48665dcb8d14186b33dad90aa40ae0","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109736,"url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-heap-buffer-overflow-via-lcevc-enhancement-decoding","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}