FFmpeg up to 9.0.2 LCL Decoder libavcodec/lcldec.c decode_frame integer underflow

Summaryinfo

A vulnerability was found in FFmpeg up to 9.0.2. It has been declared as problematic. Impacted is the function decode_frame of the file libavcodec/lcldec.c of the component LCL Decoder. Executing a manipulation can lead to integer underflow. This vulnerability is handled as CVE-2026-125197. It is possible to launch the attack on the local host. There is not any exploit available.

Detailsinfo

A vulnerability classified as problematic was found in FFmpeg up to 9.0.2. This vulnerability affects the function decode_frame of the file libavcodec/lcldec.c of the component LCL Decoder. The manipulation with an unknown input leads to a integer underflow vulnerability. The CWE definition for the vulnerability is CWE-191. The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

FFmpeg through 9.0.2 contains an integer underflow in decode_frame() in libavcodec/lcldec.c that allows attackers to trigger a heap out-of-bounds read via short ZLIB packets with FLAG_MULTITHREAD. Attackers can supply a crafted AVI or MKV file with an LCL video stream whose packet is shorter than 8 bytes, bypassing length clamping to crash the decoding application.

The advisory is available at code.ffmpeg.org. This vulnerability was named CVE-2026-125197 since 11/09/2026. The exploitation appears to be easy. Local access is required to approach this attack. Successful exploitation requires user interaction by the victim. Technical details are known, but there is no available exploit. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 11/09/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Multimedia Processing Software

Name

• FFmpeg

Version

• 9.0.0
• 9.0.1
• 9.0.2

License

• open-source

Website

• Product: https://ffmpeg.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion