{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/cve-2026-125241/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7,"id":"CVE-2026-125241"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["FFmpeg (\u003c= 9.0.2)"],"_cs_severities":["high"],"_cs_tags":["cve-2026-125241","heap-overflow","ffmpeg","remote-code-execution"],"_cs_type":"advisory","_cs_vendors":["FFmpeg"],"content_html":"\u003cp\u003eFFmpeg versions through 9.0.2 contain a heap-based buffer overflow vulnerability in \u003ccode\u003elibavcodec/flicvideo.c\u003c/code\u003e. The flaw exists in the \u003ccode\u003echeck_pixel_ptr()\u003c/code\u003e function, which fails to correctly validate bounds when processing FLIC files containing negative-stride frames. An attacker can supply a specially crafted FLIC file to trigger an out-of-bounds write, leading to heap memory corruption.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation may result in an application crash (denial of service) or the potential for arbitrary code execution within the context of the user running the FFmpeg-enabled application.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eInventory systems and software utilizing FFmpeg libraries.\u003c/li\u003e\n\u003cli\u003eMonitor for the release of patched versions of FFmpeg beyond 9.0.2 and prioritize updates for all affected integrations.\u003c/li\u003e\n\u003cli\u003eImplement memory safety mitigations at the compiler or OS level (e.g., ASLR, DEP) to reduce the likelihood of successful exploitation where possible.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-09T19:55:56Z","date_published":"2026-11-09T19:55:56Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ffmpeg-cve-2026-125241/","summary":"FFmpeg versions 9.0.2 and earlier are vulnerable to a heap buffer overflow in the libavcodec/flicvideo.c component, which could allow remote code execution or application crashes via crafted FLIC files.","title":"FFmpeg: Heap buffer overflow in libavcodec/flicvideo.c (CVE-2026-125241)","url":"https://feed.craftedsignal.io/briefs/2026-11-ffmpeg-cve-2026-125241/"}],"language":"en","title":"CraftedSignal Threat Feed - Cve-2026-125241","version":"https://jsonfeed.org/version/1.1"}