CVE-2026-125208: FFmpeg through 9.0.2 V4L2 M2M Encoder Out-of-Bounds Write in v4l2_buffers.c

Q: Which FFmpeg deployments are exposed?

The issue affects FFmpeg versions through 9.0.2 when they perform V4L2 memory-to-memory encoding. Workflows that do not use the V4L2 M2M encoder are not identified as affected by the available information.

Q: What does exploitation require?

An attacker must be able to provide crafted video input with dimensions or padding that trigger unsigned wraparound during V4L2 M2M encoding. The supplied CVSS vector characterizes exploitation as local, high complexity, requiring no privileges but requiring user interaction.

Q: How can I determine whether my environment may be affected?

Check whether the deployed FFmpeg version is 9.0.2 or earlier and whether it uses libavcodec V4L2 M2M encoding. The vulnerable code path is v4l2_buffer_swframe_to_buf() in libavcodec/v4l2_buffers.c.

Published Nov 9, 2026

Updated

FFmpeg through 9.0.2 contains an out-of-bounds write vulnerability in v4l2bufferswframetobuf() in libavcodec/v4l2buffers.c because cumulative plane offsets are not checked against the V4L2 buffer length. Attackers can supply crafted video whose dimensions or padding cause unsigned wraparound in v4l2bufreftobuf(), making memcpy() write past the mmaped driver buffer during V4L2 M2M encoding.

Affected Software

1 affected component

FFmpeg FFmpeg<=9.0.2

Event History

Nov 9, 2026

CVE Published

via MITRE·07:11 PM

Data Sourced

via MITRE·07:11 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which FFmpeg deployments are exposed?

The issue affects FFmpeg versions through 9.0.2 when they perform V4L2 memory-to-memory encoding. Workflows that do not use the V4L2 M2M encoder are not identified as affected by the available information.

What does exploitation require?

An attacker must be able to provide crafted video input with dimensions or padding that trigger unsigned wraparound during V4L2 M2M encoding. The supplied CVSS vector characterizes exploitation as local, high complexity, requiring no privileges but requiring user interaction.

How can I determine whether my environment may be affected?

Check whether the deployed FFmpeg version is 9.0.2 or earlier and whether it uses libavcodec V4L2 M2M encoding. The vulnerable code path is v4l2_buffer_swframe_to_buf() in libavcodec/v4l2_buffers.c.

CVE-2026-125208: FFmpeg through 9.0.2 V4L2 M2M Encoder Out-of-Bounds Write in v4l2_buffers.c

Affected Software

Event History

Frequently Asked Questions

Which FFmpeg deployments are exposed?

What does exploitation require?

How can I determine whether my environment may be affected?

Company

Resources

Contact

Frequently Asked Questions

Which FFmpeg deployments are exposed?

What does exploitation require?

How can I determine whether my environment may be affected?