Heap Buffer Overflow Vulnerability in FFmpeg Affected by LCEVC Enhancement Data

CVE-2026-125262

What is CVE-2026-125262?

A heap buffer overflow vulnerability exists in FFmpeg versions up to 9.0.2, specifically within the LCEVC decoding functionality in the libavcodec component. This vulnerability arises from the lack of validation of output picture dimensions against the allocated frame when processing LCEVC enhancement data. Attackers can exploit this vulnerability by embedding specially crafted LCEVC data in H.264 or HEVC streams, which may result in the corruption of heap memory during decoding operations. This can potentially allow for arbitrary code execution or other malicious activities within affected applications.

References