UBUNTU-CVE-2026-125197: Medium severity ubuntu/ffmpeg vulnerability
FFmpeg through 9.0.2 contains an integer underflow in decodeframe() in libavcodec/lcldec.c that allows attackers to trigger a heap out-of-bounds read via short ZLIB packets with FLAGMULTITHREAD. Attackers can supply a crafted AVI or MKV file with an LCL video stream whose packet is shorter than 8 bytes, bypassing length clamping to crash the decoding application.
Affected Software
Event History
Frequently Asked Questions
What must an attacker provide to trigger this issue?
The attacker must get a user or application to decode a crafted AVI or MKV file containing an LCL video stream. The malicious stream uses a short ZLIB packet, shorter than 8 bytes, with FLAG_MULTITHREAD set.
What is the practical impact of successful exploitation?
Successful exploitation triggers a heap out-of-bounds read that can crash the application performing the decode. The supplied data identifies availability impact as high and confidentiality impact as low.
Are systems exposed without user interaction?
The vector requires local access and user interaction. Exposure exists where a user opens or an application processes an attacker-supplied AVI or MKV file using the affected FFmpeg decoder.