Memory Exhaustion Vulnerability in FFmpeg 9.0 to 9.0.2 Due to LCEVC Output Validation Issue
CVE-2026-125263

5.7MEDIUM

Key Information:

Vendor

Ffmpeg

Status
Ffmpeg
Vendor
CVE Published:
9 November 2026

What is CVE-2026-125263?

FFmpeg versions 9.0 to 9.0.2 contain a flaw in the handling of LCEVC enhanced output dimensions. The library fails to properly validate these dimensions against maximum pixel limits prior to frame allocation in libavcodec/decode.c. This oversight allows attackers to exploit the system by providing specially crafted H.264, HEVC, or VVC streams with excessively large LCEVC resolutions, leading to memory exhaustion as oversized allocations are requested via the get_buffer2() function.

Affected Version(s)

FFmpeg 9.0 <= 9.0.2

References

https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25408
issue-tracking
https://github.com/FFmpeg/FFmpeg/commit/60b286521b46caa09...
patch
https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/d...
technical-description

CVSS V4

Score:
5.7
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Joshua Rogers (AISLE Research)
Michael Niedermayer
.