Heap Buffer Overflow in FFmpeg Affected by Crafted FLIC Files

CVE-2026-125241

What is CVE-2026-125241?

The vulnerability in FFmpeg's libavcodec through version 9.0.2 arises from a heap buffer overflow in the processing of FLIC files. The function check_pixel_ptr() inadequately checks boundaries when processing negative-stride frames, allowing attackers to provide specially crafted FLIC files. These files can cause the RLE and delta chunks to write pixel data beyond the allocated frame storage, leading to heap memory corruption. Exploitation of this vulnerability may result in application crashes or facilitate arbitrary code execution.

References