CVE-2026-125181: FFmpeg through 9.0.2 FLIC Decoder Out-of-Bounds Write via FLI_BRUN Byte Swap

Q: Which systems are exposed to this issue?

The vulnerable path affects FFmpeg through 9.0.2 on big-endian builds. The crafted input must use 15- or 16-bits-per-pixel FLIC/FLX content with an FLI_BRUN chunk.

Q: What does an attacker need to exploit it?

An attacker needs to cause the target process to decode a crafted FLIC/FLX file. The supplied file must trigger the non-terminating byte-swap loop in the FLI_BRUN handling path.

Q: What is the likely impact of successful exploitation?

Successful exploitation can write packet-derived data beyond the frame buffer and corrupt heap memory. The described result is a process crash, while the severity vector also rates confidentiality, integrity, and availability as high.

Published Nov 9, 2026

Updated

FFmpeg through 9.0.2 contains an out-of-bounds write vulnerability in flicdecodeframe1516BPP() in libavcodec/flicvideo.c that allows attackers to corrupt heap memory on big-endian builds. Attackers can supply a crafted 15/16 bpp FLIC/FLX file with an FLIBRUN chunk whose non-terminating byte-swap loop writes packet-derived data past the frame buffer, crashing the process.

Affected Software

1 affected component

FFmpeg FFmpeg<=9.0.2

Event History

Nov 9, 2026

CVE Published

via MITRE·07:11 PM

Data Sourced

via MITRE·07:11 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which systems are exposed to this issue?

The vulnerable path affects FFmpeg through 9.0.2 on big-endian builds. The crafted input must use 15- or 16-bits-per-pixel FLIC/FLX content with an FLI_BRUN chunk.

What does an attacker need to exploit it?

An attacker needs to cause the target process to decode a crafted FLIC/FLX file. The supplied file must trigger the non-terminating byte-swap loop in the FLI_BRUN handling path.

What is the likely impact of successful exploitation?

Successful exploitation can write packet-derived data beyond the frame buffer and corrupt heap memory. The described result is a process crash, while the severity vector also rates confidentiality, integrity, and availability as high.

CVE-2026-125181: FFmpeg through 9.0.2 FLIC Decoder Out-of-Bounds Write via FLI_BRUN Byte Swap

Affected Software

Event History

Frequently Asked Questions

Which systems are exposed to this issue?

What does an attacker need to exploit it?

What is the likely impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which systems are exposed to this issue?

What does an attacker need to exploit it?

What is the likely impact of successful exploitation?