FFMPEG · CVE-2026-125208 · Runtime
NO FIX YET · SEE WHAT TO DO
FFmpeg through 9.0.2 has an out-of-bounds write in the V4L2 M2M encoding path, where plane offsets are not checked against the buffer length. A crafted video with specific dimensions or padding can make memcpy() write past the driver buffer, which can corrupt memory.
first public Nov 9, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
FFmpeg up to 9.0.2 is affected when it encodes video through the V4L2 M2M encoders (the *_v4l2m2m encoders, typically on Linux hardware such as embedded boards with V4L2 codec drivers). Exploitation needs crafted video input with particular dimensions or padding. Systems that never use V4L2 M2M encoding, or only encode trusted input, can skip it.
Not affected if no-v4l2-encoding, trusted-input-only
Who cares ffmpeg, linux, v4l2, video-encoding
ffmpeg -version; versions up to and including 9.0.2 are listed as affected.ffmpeg -encoders | grep v4l2m2m; if no *_v4l2m2m encoder is listed, or you never use one, the vulnerable path is not used.fixing buffer alignment issue), which validates layout against the V4L2 buffer length before copyingFFmpeg through 9.0.2 contains an out-of-bounds write vulnerability in v4l2_buffer_swframe_to_buf() in libavcodec/v4l2_buffers.c because cumulative plane offsets are not checked against the V4L2 buffer length. Attackers can supply crafted video whose dimensions or padding cause unsigned wraparound in v4l2_bufref_to_buf(), making memcpy() write past the mmaped driver buffer during V4L2 M2M encoding.
This page as .md · .json · CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.