FFmpeg through 9.0.2 V4L2 M2M Encoder Out-of-Bounds Write in v4l2_buffers.c

Advisories

FFmpeg through 9.0.2 V4L2 M2M Encoder Out-of-Bounds Write in v4l2_buffers.c

Severity: high
Date: 11/9/2026
Affecting: FFmpeg <= 9.0.2
CVE: CVE-2026-125208
CWE: CWE-787 Out-of-bounds Write
CVSS: 7.3
CVSS V4 Vector: CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24328
Patch Commit
https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/v4l2_buffers.c#L309
https://github.com/FFmpeg/FFmpeg
Credit: Joshua Rogers (AISLE Research), Wenjie Yin
Description: FFmpeg through 9.0.2 contains an out-of-bounds write vulnerability in v4l2_buffer_swframe_to_buf() in libavcodec/v4l2_buffers.c because cumulative plane offsets are not checked against the V4L2 buffer length. Attackers can supply crafted video whose dimensions or padding cause unsigned wraparound in v4l2_bufref_to_buf(), making memcpy() write past the mmaped driver buffer during V4L2 M2M encoding.

Ready to get Started?

Explore VulnCheck, a next-generation Cyber Threat Intelligence platform, which provides exploit and vulnerability intelligence to help you prioritize and remediate vulnerabilities that matter.

Vulnerability Prioritization
Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.
Early Warning System
Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

Schedule a Demo