CVE-2026-125197: FFmpeg through 9.0.2 Heap Out-of-Bounds Read via LCL/ZLIB Multithread Decoding

Q: Who is exposed to this issue?

Applications that use affected FFmpeg versions to decode attacker-supplied AVI or MKV files containing an LCL video stream are exposed. The attack requires local access according to the supplied vector, but exploitation also requires a user or application to process the crafted media file.

Q: What does an attacker need to provide?

The attacker needs a crafted AVI or MKV file with an LCL video stream containing a short ZLIB packet, specifically a packet shorter than 8 bytes, with FLAG_MULTITHREAD set. Processing that file can trigger the out-of-bounds read and crash the decoding application.

Q: What is the likely impact?

The described outcome is a heap out-of-bounds read that can crash the application performing decoding, resulting in a denial of service. The provided data indicates limited confidentiality impact and does not indicate integrity impact.

Published Nov 9, 2026

Updated

FFmpeg through 9.0.2 contains an integer underflow in decodeframe() in libavcodec/lcldec.c that allows attackers to trigger a heap out-of-bounds read via short ZLIB packets with FLAGMULTITHREAD. Attackers can supply a crafted AVI or MKV file with an LCL video stream whose packet is shorter than 8 bytes, bypassing length clamping to crash the decoding application.

Affected Software

1 affected component

FFmpeg FFmpeg<=9.0.2

Event History

Nov 9, 2026

CVE Published

via MITRE·07:11 PM

Data Sourced

via MITRE·07:11 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Applications that use affected FFmpeg versions to decode attacker-supplied AVI or MKV files containing an LCL video stream are exposed. The attack requires local access according to the supplied vector, but exploitation also requires a user or application to process the crafted media file.

What does an attacker need to provide?

The attacker needs a crafted AVI or MKV file with an LCL video stream containing a short ZLIB packet, specifically a packet shorter than 8 bytes, with FLAG_MULTITHREAD set. Processing that file can trigger the out-of-bounds read and crash the decoding application.

What is the likely impact?

The described outcome is a heap out-of-bounds read that can crash the application performing decoding, resulting in a denial of service. The provided data indicates limited confidentiality impact and does not indicate integrity impact.

CVE-2026-125197: FFmpeg through 9.0.2 Heap Out-of-Bounds Read via LCL/ZLIB Multithread Decoding

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to provide?

What is the likely impact?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to provide?

What is the likely impact?