FFmpeg through 9.0.2 Heap Buffer Overflow via LCEVC Enhancement Decoding
Only FFmpeg 7.1 through 9.0.2 built against liblcevc_dec and decoding LCEVC enhancement data is affected. The fix is listed for FFmpeg 9.1.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Exploited
- No known exploitation
- Fix
- Fixed in 9.1
- Who is exposed
- Specific setups only
Do first: Check whether your setup matches what the bug needs. FFmpeg LCEVC decoding is in use (libavcodec/lcevcdec.c, built against liblcevc_dec) Affected FFmpeg versions are 7.1 through 9.0.2
- Last modified
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 14/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
FFmpeg versions up to 9.0.2 have a heap buffer overflow in the LCEVC enhancement decoder, which can corrupt memory in applications that decode crafted H.264 or HEVC streams. An attacker needs local access and must get a user to open or process a malicious file, and the bug does not require logging in.
Read the original description
FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in libavcodec/lcevcdec.c because LCEVC output picture dimensions are not validated against the allocated frame. Attackers can embed crafted LCEVC enhancement data with differing global configurations in H.264 or HEVC streams to corrupt heap memory in decoding applications.
cve.now Index
- Exploitation?/40Unknown. No CISA SSVC exploitation rating yet
- Exposure5/25Specific setups only
- Reach?/20Unknown. No tracked technology or package matched
- Severity8.5/10CVSS 8.5
- No patch0/5No signal
What would change the score
- Would score about 64 if added to CISA KEV
- Would score about 59 if CISA's SSVC rates exploitation active
- Would score about 24 if CISA's SSVC rates it automatable
What to do
Check whether your setup matches what the bug needs.
FFmpeg LCEVC decoding is in use (libavcodec/lcevcdec.c, built against liblcevc_dec) Affected FFmpeg versions are 7.1 through 9.0.2Upgrade to a fixed version: 9.1.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- FFmpeg FFmpeg
From 7.1 · through 9.0.2
Evidence 5
- Patch
- Report
- Repository
- Repository
- Link
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-125262
Is CVE-2026-125262 being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
What does this mean?
Crafted LCEVC enhancement data in H.264 or HEVC streams can make FFmpeg write past the end of a heap buffer. This corrupts heap memory in applications that decode such streams.Source: vulncheck.com, code.ffmpeg.org
Which versions are affected by CVE-2026-125262?
FFmpeg: from 7.1 through 9.0.2.Source: cve.now feed data
Am I affected, and how do I check?
FFmpeg versions 7.1 through 9.0.2 are affected, and only when LCEVC decoding is in use (libavcodec/lcevcdec.c built against liblcevc_dec). Check the installed version with ffmpeg -version and whether the build includes liblcevc_dec.Source: vulncheck.com, code.ffmpeg.org
How do I fix CVE-2026-125262?
The fix is listed for FFmpeg 9.1, so upgrade to 9.1 or later once it is available.Source: vulncheck.com, code.ffmpeg.org