---
id: CVE-2026-125262
title: FFmpeg through 9.0.2 Heap Buffer Overflow via LCEVC Enhancement Decoding
summary: >-
  FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in
  libavcodec/lcevcdec.c because LCEVC output picture dimensions are not
  validated against the allocated frame. Attackers can embed crafted LCEVC
  enhancement data with di…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-787
vendor: FFmpeg
product: FFmpeg
affected:
  - FFmpeg >= 7.1 <= 9.0.2
published: '2026-11-09'
updated: '2026-11-09'
sourceUpdated: '2026-11-09T19:12:04.655Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-125262'
references:
  - url: 'https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25067'
  - url: >-
      https://github.com/FFmpeg/FFmpeg/commit/fd6dfa613a48665dcb8d14186b33dad90aa40ae0
    label: Patch Commit
  - url: 'https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/lcevcdec.c#L224'
  - url: 'https://github.com/FFmpeg/FFmpeg'
  - url: >-
      https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-heap-buffer-overflow-via-lcevc-enhancement-decoding
    label: >-
      VulnCheck Advisory: FFmpeg through 9.0.2 Heap Buffer Overflow via LCEVC
      Enhancement Decoding
tags:
  - cve.org
ingestedAt: '2026-11-09T20:27:27.079Z'
---

## Overview

FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in libavcodec/lcevcdec.c because LCEVC output picture dimensions are not validated against the allocated frame. Attackers can embed crafted LCEVC enhancement data with differing global configurations in H.264 or HEVC streams to corrupt heap memory in decoding applications.

## Affected

- `FFmpeg >= 7.1 <= 9.0.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.