CVE-2026-125262: FFmpeg through 9.0.2 Heap Buffer Overflow via LCEVC Enhancement Decoding
FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in libavcodec/lcevcdec.c because LCEVC output picture dimensions are not validated against the allocated frame. Attackers can embed crafted LCEVC enhancement data with differing global configurations in H.264 or HEVC streams to corrupt heap memory in decoding applications.
Affected Software
Event History
Frequently Asked Questions
Which deployments are realistically exposed?
Applications that use FFmpeg to decode H.264 or HEVC streams containing LCEVC enhancement data are exposed when they process attacker-controlled media.
What does an attacker need to provide to trigger the issue?
The attacker needs to supply a crafted H.264 or HEVC stream containing LCEVC enhancement data with differing global configurations. Exploitation requires the target application to decode that media, and the supplied CVSS vector indicates user interaction is required.