CVE-2026-125263: FFmpeg 9.0 through 9.0.2 Memory Exhaustion via LCEVC Enhancement Dimensions
FFmpeg 9.0 through 9.0.2 built with liblcevcdec fails to validate LCEVC enhanced output dimensions against maxpixels in libavcodec/decode.c before frame allocation. Attackers can supply crafted H.264, HEVC or VVC streams declaring huge LCEVC resolutions to force oversized getbuffer2() allocations and exhaust memory.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
FFmpeg versions 9.0 through 9.0.2 are affected when built with liblcevc_dec. The issue applies when decoding crafted H.264, HEVC, or VVC streams carrying LCEVC enhancement data.
What does exploitation require?
An attacker must provide a crafted media stream that declares an extremely large LCEVC enhanced resolution. The supplied vector indicates local attack access, high attack complexity, no privileges required, and user interaction required.
What is the impact of a successful exploit?
The crafted dimensions can cause oversized get_buffer2() frame allocations, exhausting available memory. The stated impact is availability loss; no confidentiality or integrity impact is indicated.
How can I determine whether a system is affected?
Check whether the deployed FFmpeg version is 9.0, 9.0.1, or 9.0.2 and whether it was built with liblcevc_dec. Systems that do not decode LCEVC-enhanced H.264, HEVC, or VVC input are not described as exposed by the provided information.