CVE-2026-125263

FFmpeg 9.0 through 9.0.2 built with liblcevcdec fails to validate LCEVC enhanced output dimensions against maxpixels in libavcodec/decode.c before frame allocation. Attackers can supply crafted H.264, HEVC or VVC streams declaring huge LCEVC resolutions to force oversized getbuffer2 allocations a...

CVE-2026-125263 FFmpeg 9.0 through 9.0.2 Memory Exhaustion via LCEVC Enhancement Dimensions

FFmpeg 9.0 through 9.0.2 built with liblcevcdec fails to validate LCEVC enhanced output dimensions against maxpixels in libavcodec/decode.c before frame allocation. Attackers can supply crafted H.264, HEVC or VVC streams declaring huge LCEVC resolutions to force oversized getbuffer2 allocations a...

CVE-2026-125263 FFmpeg 9.0 through 9.0.2 Memory Exhaustion via LCEVC Enhancement Dimensions

FFmpeg 9.0 through 9.0.2 built with liblcevcdec fails to validate LCEVC enhanced output dimensions against maxpixels in libavcodec/decode.c before frame allocation. Attackers can supply crafted H.264, HEVC or VVC streams declaring huge LCEVC resolutions to force oversized getbuffer2 allocations a...

EUVD-2026-120213

FFmpeg 9.0 through 9.0.2 built with liblcevcdec fails to validate LCEVC enhanced output dimensions against maxpixels in libavcodec/decode.c before frame allocation. Attackers can supply crafted H.264, HEVC or VVC streams declaring huge LCEVC resolutions to force oversized getbuffer2 allocations a...

CVE-2026-125263

FFmpeg versions 9.0 through 9.0.2 built with liblcevc_dec are vulnerable to a memory exhaustion issue located in libavcodec/decode.c. The root cause is a failure to validate LCEVC enhanced output dimensions against max_pixels prior to frame allocation. An attacker can provide crafted H.264, HEVC,...

PT-2026-141091

FFmpeg 9.0 through 9.0.2 built with liblcevc dec fails to validate LCEVC enhanced output dimensions against max pixels in libavcodec/decode.c before frame allocation. Attackers can supply crafted H.264, HEVC or VVC streams declaring huge LCEVC resolutions to force oversized get buffer2 allocation...

CVE-2026-125263: FFmpeg: FFmpeg 9.0 through 9.0.2 built with liblcevc_dec fails to validate LCEVC enhanced output dimensions against max_pixels…

FFmpeg 9.0 through 9.0.2 built with liblcevcdec fails to validate LCEVC enhanced output dimensions against maxpixels in libavcodec/decode.c before frame allocation. Attackers can supply crafted H.264, HEVC or VVC streams declaring huge LCEVC resolutions to force oversized getbuffer2 allocations a...