UBUNTU-CVE-2026-125263: Medium severity ubuntu/ffmpeg vulnerability

Published Nov 10, 2026

Updated

FFmpeg 9.0 through 9.0.2 built with liblcevcdec fails to validate LCEVC enhanced output dimensions against maxpixels in libavcodec/decode.c before frame allocation. Attackers can supply crafted H.264, HEVC or VVC streams declaring huge LCEVC resolutions to force oversized getbuffer2() allocations and exhaust memory.

Affected Software

7 affected components

ubuntu/ffmpeg*

Event History

Nov 10, 2026

CVE Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which systems are exposed to this issue?

Exposure requires FFmpeg 9.0 through 9.0.2 to be built with liblcevc_dec and to process attacker-controlled H.264, HEVC, or VVC streams containing LCEVC-enhanced output data. Systems not built with liblcevc_dec are not identified as affected by the provided data.

What does an attacker need to do to trigger the memory exhaustion?

An attacker needs to provide a crafted H.264, HEVC, or VVC stream that declares an excessively large LCEVC enhanced resolution. Exploitation also requires user interaction and has high attack complexity according to the supplied vector.

What is the expected impact if exploitation succeeds?

The crafted dimensions can cause oversized get_buffer2() frame allocations, exhausting available memory. The stated impact is limited to availability; no confidentiality or integrity impact is indicated.

UBUNTU-CVE-2026-125263: Medium severity ubuntu/ffmpeg vulnerability

Affected Software

Event History

Frequently Asked Questions

Which systems are exposed to this issue?

What does an attacker need to do to trigger the memory exhaustion?

What is the expected impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

Which systems are exposed to this issue?

What does an attacker need to do to trigger the memory exhaustion?

What is the expected impact if exploitation succeeds?