FFmpeg (Through 9.0.2) - CraftedSignal Threat Feed

FFmpeg: Heap memory corruption via double free vulnerability (CVE-2026-125269)

hello@craftedsignal.io — Mon, 09 Nov 2026 23:59:35 +0000

FFmpeg through 9.0.2 contains a double free vulnerability in libavcodec/cbs_sei.c where cbs_sei_delete_message() leaves a stale extension_data reference that ff_cbs_sei_add_message() reuses. Attackers can supply a crafted H.264 stream with a display orientation SEI message followed by payload extension data, processed by h264_metadata with display_orientation=insert, to corrupt heap memory.

FFmpeg: Heap overflow in libavcodec/qsvenc.c (CVE-2026-125235)

hello@craftedsignal.io — Mon, 09 Nov 2026 23:59:00 +0000

FFmpeg through 9.0.2 contains a heap overflow vulnerability in libavcodec/qsvenc.c. Attackers can supply crafted input that increases in resolution mid-stream, which, when transcoded with Intel Quick Sync encoders without rescaling, causes the application to reuse an undersized pooled QSVFrame buffer. This results in heap memory corruption or application crashes.

FFmpeg: Heap buffer overflow in Huffyuv encoder (CVE-2026-125256)

hello@craftedsignal.io — Mon, 09 Nov 2026 21:58:26 +0000

FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in the ff_llvidenc_diff_bytes_rvv() function. Attackers can supply RGB video narrower than 8 or 16 pixels for huffyuv transcoding on RVV-enabled RISC-V builds, causing writes past the encoder's temp buffer and resulting in heap memory corruption.

FFmpeg: Out-of-bounds write vulnerability in v4l2_buffer_swframe_to_buf() (CVE-2026-125208)

hello@craftedsignal.io — Mon, 09 Nov 2026 19:52:33 +0000

FFmpeg through 9.0.2 contains an out-of-bounds write vulnerability in the v4l2_buffer_swframe_to_buf() function within libavcodec/v4l2_buffers.c. This issue arises because cumulative plane offsets are not validated against the V4L2 buffer length. An attacker can provide crafted video with dimensions or padding that trigger an unsigned wraparound in v4l2_bufref_to_buf(), causing memcpy() to write past the mmaped driver buffer during V4L2 M2M encoding.