# CVE-2026-125263: FFmpeg LCEVC dimension validation bypass memory exhaustion

Source: https://junglewise.ai/threats/cve-2026-125263-ffmpeg-9-0-through-9-0-2-built-with-liblcevc-dec-fails-to  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-09. Updated: 2026-11-09  
License: CC BY 4.0 with a link back

CVE-2026-125263 · Severity: medium · CVSS 4.7 · Published 2026-11-09

FFmpeg, a widely-used multimedia processing library, fails to properly validate image dimensions declared in LCEVC-enhanced H.264, HEVC, and VVC video streams. An attacker can craft malicious video files with abnormally large LCEVC resolution declarations to trigger excessive memory allocation and exhaust system resources, causing denial of service or application crashes.

Technologies: [Ffmpeg](https://junglewise.ai/threats/technologies/ffmpeg). Vendors: [Ffmpeg](https://junglewise.ai/threats/vendors/ffmpeg).

## Quick answers

**Is CVE-2026-125263 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-125263 being exploited in the wild.

**How severe is CVE-2026-125263?** Medium severity, with a CVSS score of 4.7, published 9 November 2026.

**Which products and versions are affected?** Ffmpeg 9.0 through 9.0.2.

**Is there a fix for CVE-2026-125263?** Yes: fixed in FFmpeg 9.1. Until then: Disable LCEVC decoding support or use an FFmpeg build without liblcevc_dec linked if not needed, or restrict processing to video files from trusted sources until patched. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-125263 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-125263?** Check whether you run Ffmpeg at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in FFmpeg 9.1

Disable LCEVC decoding support or use an FFmpeg build without liblcevc_dec linked if not needed, or restrict processing to video files from trusted sources until patched.

## Technical details

The vulnerability is a max_pixels bypass in FFmpeg's LCEVC decoder (libavcodec/lcevcdec) where crafted LCEVC enhanced picture size values are not validated against the max_pixels limit before buffer allocation. An attacker can supply malicious H.264, HEVC, or VVC streams declaring huge LCEVC resolutions (e.g., 16000x16000) to force oversized get_buffer2() memory allocations. The fix validates the enhanced picture size against max_pixels in the caller (decode.c) before frame allocation.

## Affected products

- FFmpeg FFmpeg 9.0 through 9.0.2

## Timeline

- 2026-11-09: disclosed: Published on NVD
- 2026-11-06: patched: Fix merged upstream in PR #25408

## References

- [https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25408](https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25408)
- [https://github.com/FFmpeg/FFmpeg](https://github.com/FFmpeg/FFmpeg)

## Related threats

- [FFmpeg heap out-of-bounds read in v4l2_buffers](https://junglewise.ai/threats/cve-2026-125270-ffmpeg-through-9-0-2-contains-a-heap-out-of-bounds-read)
- [FFmpeg double free in H.264 SEI message handling](https://junglewise.ai/threats/cve-2026-125269-ffmpeg-through-9-0-2-contains-a-double-free-vulnerability-in)
- [FFmpeg heap out-of-bounds write in APAC decoder](https://junglewise.ai/threats/cve-2026-125267-ffmpeg-before-8-1-3-and-9-x-before-9-0-2-contains-a-heap-out-of)
- [FFmpeg use-after-free in NVIDIA codec decoding](https://junglewise.ai/threats/cve-2026-125265-ffmpeg-through-9-0-2-contains-a-use-after-free-vulnerability-in)
- [FFmpeg JPEG XL parser uncontrolled resource consumption](https://junglewise.ai/threats/cve-2026-125264-ffmpeg-through-9-0-2-contains-an-uncontrolled-resource)