CVE-2026-125181

FFmpeg through 9.0.2 contains an out-of-bounds write vulnerability in flic decode frame 15 16BPP() in libavcodec/flicvideo.c that allows attackers to corrupt heap memory on big-endian builds. Attackers can supply a crafted 15/16 bpp FLIC/FLX file with an FLI BRUN chunk whose non-terminating byte-swap loop writes packet-derived data past the frame buffer, crashing the process.