---
id: "CVE-2026-125262"
page: "https://infrastack.ai/live/CVE-2026-125262"
kind: "vulnerability"
aliases: ["CVE-2026-125262"]
title: "FFmpeg: crafted LCEVC data in video streams overflows heap memory"
severity: "high"
cvss: 8.5
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "ffmpeg", "fixed": [], "affected": ">= 7.1, <= 9.0.2", "ecosystem": "vendor"}]
ecosystems: []
tags: ["ffmpeg", "lcevc", "libavcodec", "runtime", "video-processing"]
not_affected_if: ["no-liblcevc-dec", "trusted-input-only"]
published_at: "2026-11-09T20:18:12+00:00"
first_seen_at: "2026-11-09T20:48:13+00:00"
updated_at: "2026-11-09T20:51:01+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-125262", "first_seen_at": "2026-11-09T20:48:13+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-09T20:51:01+00:00"}]
exploit_sources: []
---

# FFmpeg: crafted LCEVC data in video streams overflows heap memory

Link for people: https://infrastack.ai/live/CVE-2026-125262 (this .md is for agents)

FFmpeg through 9.0.2 fails to check LCEVC output picture dimensions against the allocated frame in libavcodec/lcevcdec.c. A crafted H.264 or HEVC stream carrying LCEVC enhancement data can corrupt heap memory in a decoding application.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:ffmpeg affected >= 7.1, <= 9.0.2 fixed no fixed version listed

## How to check

- Run ffmpeg -version and look for --enable-liblcevc-dec in the configuration line (inferred from the commit touching lcevc_dec in configure; the sources do not say this outright). If it is absent, the LCEVC code path is probably not built in.
- If it is present and the version is 7.1 through 9.0.2 without commit fd6dfa6, you are in range, and any service that decodes untrusted H.264 or HEVC video is exposed.
- Also check distro or vendor FFmpeg packages and apps that bundle libavcodec.

## Fix

No fixed release is named in the sources. The fix is upstream commit fd6dfa613a48665dcb8d14186b33dad90aa40ae0 (avcodec/lcevcdec: check the picture LCEVCdec will output against the one allocated), which also raises the required lcevc_dec library to 4.2.0. Use a build that includes that commit; check FFmpeg's release page for the first release that does.

## Timeline

- 2026-11-09T20:48:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-125262
- 2026-11-09T20:51:01+00:00 analyst — Read the FFmpeg commit fd6dfa6 (fix) and VulnCheck advisory (third-party). Affected >=7.1,<=9.0.2 per VulnCheck; no fixed release named in either. web-cli out of Exa credits, used WebFetch. Default enablement not stated; commit bumps configure's lcevc_dec requirement to 4.2.0, which implies an optional external library build.

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-heap-buffer-overflow-via-lcevc-enhancement-decoding
- [fix] Patch: github.com https://github.com/FFmpeg/FFmpeg/commit/fd6dfa613a48665dcb8d14186b33dad90aa40ae0

## From the sources

FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in libavcodec/lcevcdec.c because LCEVC output picture dimensions are not validated against the allocated frame. Attackers can embed crafted LCEVC enhancement data with differing global configurations in H.264 or HEVC streams to corrupt heap memory in decoding applications.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_