CVE-2026-125208

Description

FFmpeg through 9.0.2 contains an out-of-bounds write vulnerability in v4l2_buffer_swframe_to_buf() in libavcodec/v4l2_buffers.c because cumulative plane offsets are not checked against the V4L2 buffer length. Attackers can supply crafted video whose dimensions or padding cause unsigned wraparound in v4l2_bufref_to_buf(), making memcpy() write past the mmaped driver buffer during V4L2 M2M encoding.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

References

• https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24328 ↗
• https://github.com/FFmpeg/FFmpeg/commit/b8f159858e2fd29dae4fa34d9e713bbf9bbf190e ↗
• https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/v4l2_buffers.c#L309 ↗
• https://github.com/FFmpeg/FFmpeg ↗
• https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-v4l2-m2m-encoder-out-of-bounds-write-in-v4l2-buffers-c ↗