CVE-2026-125241: FFmpeg through 9.0.2 Heap Buffer Overflow via FLIC Decoder check_pixel_ptr

Q: What must an attacker provide to trigger the flaw?

An attacker must supply a crafted FLIC file containing RLE and delta chunks that cause pixel data to be written beyond frame storage. The vulnerable bounds check is reached when decoding negative-stride frames.

Q: Are systems exposed remotely by default?

The provided vector indicates local attack access and user interaction is required. The data does not establish that remote exposure or default FFmpeg deployments are affected.

Q: What is the practical impact if exploitation succeeds?

Out-of-bounds writes can corrupt heap memory, causing an application crash and potentially allowing code execution. Confidentiality, integrity, and availability are all rated high in the supplied severity vector.

Published Nov 9, 2026

Updated

FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in libavcodec/flicvideo.c that allows attackers to write out of bounds because checkpixelptr() checks only one bound with negative-stride frames. Attackers can supply a crafted FLIC file whose RLE and delta chunks write pixel data past frame storage, corrupting heap memory to crash applications or possibly execute code.

Affected Software

1 affected component

FFmpeg FFmpeg<=9.0.2

Event History

Nov 9, 2026

CVE Published

via MITRE·07:11 PM

Data Sourced

via MITRE·07:11 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What must an attacker provide to trigger the flaw?

An attacker must supply a crafted FLIC file containing RLE and delta chunks that cause pixel data to be written beyond frame storage. The vulnerable bounds check is reached when decoding negative-stride frames.

Are systems exposed remotely by default?

The provided vector indicates local attack access and user interaction is required. The data does not establish that remote exposure or default FFmpeg deployments are affected.

What is the practical impact if exploitation succeeds?

Out-of-bounds writes can corrupt heap memory, causing an application crash and potentially allowing code execution. Confidentiality, integrity, and availability are all rated high in the supplied severity vector.

CVE-2026-125241: FFmpeg through 9.0.2 Heap Buffer Overflow via FLIC Decoder check_pixel_ptr

Affected Software

Event History

Frequently Asked Questions

What must an attacker provide to trigger the flaw?

Are systems exposed remotely by default?

What is the practical impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

What must an attacker provide to trigger the flaw?

Are systems exposed remotely by default?

What is the practical impact if exploitation succeeds?