FFmpeg: Heap buffer overflow in libavcodec/flicvideo.c (CVE-2026-125241)

FFmpeg versions through 9.0.2 contain a heap-based buffer overflow vulnerability in libavcodec/flicvideo.c. The flaw exists in the check_pixel_ptr() function, which fails to correctly validate bounds when processing FLIC files containing negative-stride frames. An attacker can supply a specially crafted FLIC file to trigger an out-of-bounds write, leading to heap memory corruption.

Impact

Successful exploitation may result in an application crash (denial of service) or the potential for arbitrary code execution within the context of the user running the FFmpeg-enabled application.

Recommendation

• Inventory systems and software utilizing FFmpeg libraries.
• Monitor for the release of patched versions of FFmpeg beyond 9.0.2 and prioritize updates for all affected integrations.
• Implement memory safety mitigations at the compiler or OS level (e.g., ASLR, DEP) to reduce the likelihood of successful exploitation where possible.