Medium severity4.7NVD Advisory· Published Nov 9, 2026

CVE-2026-125263

Description

FFmpeg 9.0 through 9.0.2 built with liblcevc_dec fails to validate LCEVC enhanced output dimensions against max_pixels in libavcodec/decode.c before frame allocation. Attackers can supply crafted H.264, HEVC or VVC streams declaring huge LCEVC resolutions to force oversized get_buffer2() allocations and exhaust memory.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

FFmpeg/Ffmpegllm-fuzzy
Range: 9.0 through 9.0.2

Patches

Vulnerability mechanics

References

code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25408nvd
github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/decode.cnvd
github.com/FFmpeg/FFmpeg/commit/60b286521b46caa09792af04c6a4e3437aac8293nvd
www.vulncheck.com/advisories/ffmpeg-9.0-through-9.0.2-memory-exhaustion-via-lcevc-enhancement-dimensionsnvd

News mentions

No linked articles in our index yet.

cvss	0.306
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000