Quick answers
- Is CVE-2026-125263 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-125263 being exploited in the wild.
- How severe is CVE-2026-125263?
- Medium severity, with a CVSS score of 4.7, published 9 November 2026.
- Which products and versions are affected?
- Ffmpeg 9.0 through 9.0.2.
- Is there a fix for CVE-2026-125263?
- Yes: fixed in FFmpeg 9.1. Until then: Disable LCEVC decoding support or use an FFmpeg build without liblcevc_dec linked if not needed, or restrict processing to video files from trusted sources until patched. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-125263 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-125263?
- Check whether you run Ffmpeg at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: FFmpeg 9.1
Disable LCEVC decoding support or use an FFmpeg build without liblcevc_dec linked if not needed, or restrict processing to video files from trusted sources until patched.
Technical details
The vulnerability is a max_pixels bypass in FFmpeg's LCEVC decoder (libavcodec/lcevcdec) where crafted LCEVC enhanced picture size values are not validated against the max_pixels limit before buffer allocation. An attacker can supply malicious H.264, HEVC, or VVC streams declaring huge LCEVC resolutions (e.g., 16000x16000) to force oversized get_buffer2() memory allocations. The fix validates the enhanced picture size against max_pixels in the caller (decode.c) before frame allocation.
Affected products
- FFmpeg FFmpeg 9.0 through 9.0.2
Timeline
- 2026-11-09: disclosed: Published on NVD
- 2026-11-06: patched: Fix merged upstream in PR #25408