CVE-2026-125270: FFmpeg through 9.0.2 Heap Out-of-Bounds Read in V4L2 M2M Encoder
FFmpeg through 9.0.2 contains a heap out-of-bounds read vulnerability in v4l2bufferswframetobuf() in libavcodec/v4l2buffers.c that mishandles frames with negative linesize. Attackers can supply bottom-up AVI or PNM/PFM files that are transcoded to a V4L2 M2M encoder, crashing the application or leaking heap memory into encoded output.
Affected Software
Event History
Frequently Asked Questions
What conditions are required for exploitation?
An attacker must cause FFmpeg to transcode a crafted bottom-up AVI or PNM/PFM file using a V4L2 memory-to-memory encoder. The attack requires local access and user interaction, according to the supplied CVSS vector.
What could happen if a vulnerable transcode is performed?
The malformed frame can trigger a heap out-of-bounds read. This can crash the application or cause heap memory to be included in the encoded output.
How can I determine whether a workflow is exposed?
Workflows are exposed if they use FFmpeg through 9.0.2, accept AVI or PNM/PFM input that may contain bottom-up frames, and transcode that input through a V4L2 M2M encoder. The affected function is v4l2_buffer_swframe_to_buf() in libavcodec/v4l2_buffers.c.