PT-2026-141091

CVE-2026-125263

·

Published

2026-11-09

·

Updated

2026-11-09

Description by

CVSS 3.1
4.7
Medium
MetricsAV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
FFmpeg 9.0 through 9.0.2 built with liblcevc dec fails to validate LCEVC enhanced output dimensions against max pixels in libavcodec/decode.c before frame allocation. Attackers can supply crafted H.264, HEVC or VVC streams declaring huge LCEVC resolutions to force oversized get buffer2() allocations and exhaust memory.
Exploitability
Fix
Researchers
Vendors
Affected products
Weakness enumeration
CWE-789: Memory Allocation with Excessive Size Value
Related identifiers
CVE-2026-125263
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com