# CVE-2026-125262

Heap overflow in FFmpeg LCEVC decoder allows remote memory corruption via crafted streams

- Page: https://www.vulneraibility.com/cve/CVE-2026-125262
- CVSS: 8.5
- Known exploited: not in CISA KEV as of our last sync
- Weakness: CWE-787
- Published: 2026-11-09

## Affected versions

- FFmpeg: affected >= 7.1 and <= 9.0.2

A version outside these ranges is not a statement that it is unaffected.

## Impact

Heap buffer overflow via crafted LCEVC enhancement in H.264/HEVC streams can crash decoders or enable remote code execution.

## Action

Patch when possible

## Recommendation

Update FFmpeg to the patched commit/version or rebuild from patched source.

## References

- [other] https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25067
- [patch] https://github.com/FFmpeg/FFmpeg/commit/fd6dfa613a48665dcb8d14186b33dad90aa40ae0
- [other] https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/lcevcdec.c#L224
- [other] https://github.com/FFmpeg/FFmpeg
- [advisory] https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-heap-buffer-overflow-via-lcevc-enhancement-decoding

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.