FFmpeg: Integer overflow in Vulkan encoder (CVE-2026-125248)

FFmpeg versions 9.0 through 9.0.2 contain an integer overflow vulnerability within libavcodec/ffv1enc_vulkan.c. The vulnerability manifests when the software attempts to allocate memory for the float remap GPU buffer. Supplying a large GBRPF32 or GBRAPF32 image or video for transcoding into the FFV1 format via the Vulkan encoder results in an undersized buffer allocation. This leads to an out-of-bounds GPU memory write, which can result in application crashes or memory corruption.

Impact

Successful exploitation may result in a denial of service (application crash) or potential memory corruption on the host system running the transcoding process.

Recommendation

• Inventory systems and applications utilizing FFmpeg libraries to identify exposure to versions 9.0 through 9.0.2.
• Update FFmpeg to a patched version once released by the vendor.
• Restrict the use of the Vulkan encoder in untrusted transcoding pipelines until the software is updated.