CVE-2026-89724: media: vicodec: fix out-of-bounds write in FWHT encoder

Published Sep 11, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

media: vicodec: fix out-of-bounds write in FWHT encoder

vidiocsfmtvidout() sizes the encoder CAPTURE buffer from the compressed descriptor pixfmtfwht, whose sizeimagemult is 3: codedw codedh 3 + sizeof(struct fwhtcframehdr). fwhtencodeframe() encodes one plane per component, and an incompressible plane takes the FWHTFRAMEUNENCODED path in encodeplane(), copying the plane verbatim.

For a 4-component pixel format all four planes are full resolution (widthdiv == heightdiv == 1), so a frame that forces every plane through the unencoded fallback writes sizeof(struct fwhtcframehdr) + 4 codedw codedh bytes, overrunning the plane by codedw codedh, which can result in corruption of adjacent kernel heap memory.

Bump pixfmtfwht.sizeimagemult from 3 to 4, matching the largest componentsnum among the supported raw formats, so the capture buffer is always large enough for the unencoded fallback.

Affected Software

1 affected component
Linux Linux kernel

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade vicodec FWHT encoder to a version that resolves this vulnerability.

    Patch fix out-of-bounds write in FWHT encoder

Event History

Sep 11, 2026
CVE Published
via MITRE·07:46 PM
Data Sourced
via MITRE·07:46 PM
Description

Frequently Asked Questions

1

What input conditions are needed to reach the out-of-bounds write?

The encoder must process a four-component pixel format in which all four planes are full resolution. Each plane must take the unencoded fallback path, causing four full-resolution planes to be copied into a capture buffer sized for only three.

2

How can I determine whether the fix is present?

Check whether the FWHT compressed-format sizeimage multiplier is 4 rather than 3. The fix increases pixfmt_fwht.sizeimage_mult to 4 so the capture buffer can hold the header plus four full-resolution unencoded planes.

3

What is the available remediation?

Apply the kernel change that increases the FWHT capture-buffer sizing multiplier from 3 to 4. This prevents the unencoded fallback for supported four-component raw formats from writing past the allocated capture buffer.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203