FFmpeg: Out-of-bounds write vulnerability in v4l2_buffer_swframe_to_buf() (CVE-2026-125208)
FFmpeg through 9.0.2 contains an out-of-bounds write vulnerability in libavcodec/v4l2_buffers.c triggered by crafted video input during V4L2 M2M encoding.
CVE search metadata
CVE search record: CVE-2026-125208. Severity: high. CVSS: 7.0. KEV: no. Product: FFmpeg (through 9.0.2). Brief: FFmpeg: Out-of-bounds write vulnerability in v4l2_buffer_swframe_to_buf() (CVE-2026-125208). Brief link: https://feed.craftedsignal.io/briefs/2026-11-ffmpeg-oob-write-72786597/
Triage facts
Revision 1- Applicability
- FFmpeg (through 9.0.2)
- Evidence
- Unknown
- Severity
- Medium
- Sources
- 1 public source
- Freshness
- Revision 1Nov 9, 19:52 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
FFmpeg through 9.0.2 contains an out-of-bounds write vulnerability in the v4l2_buffer_swframe_to_buf() function within libavcodec/v4l2_buffers.c. This issue arises because cumulative plane offsets are not validated against the V4L2 buffer length. An attacker can provide crafted video with dimensions or padding that trigger an unsigned wraparound in v4l2_bufref_to_buf(), causing memcpy() to write past the mmaped driver buffer during V4L2 M2M encoding.