6 matches found
CVE-2026-125263
FFmpeg 9.0 through 9.0.2 built with liblcevcdec fails to validate LCEVC enhanced output dimensions against maxpixels in libavcodec/decode.c before frame allocation. Attackers can supply crafted H.264, HEVC or VVC streams declaring huge LCEVC resolutions to force oversized getbuffer2 allocations a...
CVE-2026-125263 FFmpeg 9.0 through 9.0.2 Memory Exhaustion via LCEVC Enhancement Dimensions
FFmpeg 9.0 through 9.0.2 built with liblcevcdec fails to validate LCEVC enhanced output dimensions against maxpixels in libavcodec/decode.c before frame allocation. Attackers can supply crafted H.264, HEVC or VVC streams declaring huge LCEVC resolutions to force oversized getbuffer2 allocations a...
CVE-2026-125263 FFmpeg 9.0 through 9.0.2 Memory Exhaustion via LCEVC Enhancement Dimensions
FFmpeg 9.0 through 9.0.2 built with liblcevcdec fails to validate LCEVC enhanced output dimensions against maxpixels in libavcodec/decode.c before frame allocation. Attackers can supply crafted H.264, HEVC or VVC streams declaring huge LCEVC resolutions to force oversized getbuffer2 allocations a...
EUVD-2026-120213
FFmpeg 9.0 through 9.0.2 built with liblcevcdec fails to validate LCEVC enhanced output dimensions against maxpixels in libavcodec/decode.c before frame allocation. Attackers can supply crafted H.264, HEVC or VVC streams declaring huge LCEVC resolutions to force oversized getbuffer2 allocations a...
CVE-2026-125263
FFmpeg versions 9.0 through 9.0.2 built with liblcevc_dec are vulnerable to a memory exhaustion issue located in libavcodec/decode.c. The root cause is a failure to validate LCEVC enhanced output dimensions against max_pixels prior to frame allocation. An attacker can provide crafted H.264, HEVC,...
CVE-2026-125263: FFmpeg: FFmpeg 9.0 through 9.0.2 built with liblcevc_dec fails to validate LCEVC enhanced output dimensions against max_pixels…
FFmpeg 9.0 through 9.0.2 built with liblcevcdec fails to validate LCEVC enhanced output dimensions against maxpixels in libavcodec/decode.c before frame allocation. Attackers can supply crafted H.264, HEVC or VVC streams declaring huge LCEVC resolutions to force oversized getbuffer2 allocations a...