{"id":"CVE-2026-125208","kind":"vulnerability","aliases":["CVE-2026-125208"],"related":[],"title":"FFmpeg: crafted video causes out-of-bounds write during V4L2 encoding","description":"FFmpeg through 9.0.2 contains an out-of-bounds write vulnerability in v4l2_buffer_swframe_to_buf() in libavcodec/v4l2_buffers.c because cumulative plane offsets are not checked against the V4L2 buffer length. Attackers can supply crafted video whose dimensions or padding cause unsigned wraparound in v4l2_bufref_to_buf(), making memcpy() write past the mmaped driver buffer during V4L2 M2M encoding.","summary":"FFmpeg through 9.0.2 has an out-of-bounds write in the V4L2 M2M encoding path, where plane offsets are not checked against the buffer length. A crafted video with specific dimensions or padding can make memcpy() write past the driver buffer, which can corrupt memory.","severity":"high","cvss":7.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ffmpeg","fixed":[],"affected":"<= 9.0.2 (V4L2 M2M encoder only)","ecosystem":"vendor"}],"ecosystems":[],"tags":["ffmpeg","linux","runtime","v4l2","video-encoding"],"not_affected_if":["no-v4l2-encoding","trusted-input-only"],"how_to_check":"- Run `ffmpeg -version`; versions up to and including 9.0.2 are listed as affected.\n- Run `ffmpeg -encoders | grep v4l2m2m`; if no *_v4l2m2m encoder is listed, or you never use one, the vulnerable path is not used.\n- If you build from source, check whether libavcodec/v4l2_buffers.c contains commit b8f1598 (v4l2_buffer_swframe_to_single_buffer).","fix":"No fixed release named in the sources. The fix is upstream commit b8f159858e2fd29dae4fa34d9e713bbf9bbf190e (libavcodec/v4l2_buffers.c, 'fixing buffer alignment issue'), which validates layout against the V4L2 buffer length before copying. Until a release containing it ships, build from a master that includes the commit or avoid V4L2 M2M encoding.","status":"open","published_at":"2026-11-09T19:16:57+00:00","first_seen_at":"2026-11-09T19:28:18+00:00","triaged_at":"2026-11-09T19:30:08+00:00","updated_at":"2026-11-09T19:34:54+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-09T19:30:08Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"FFmpeg: crafted video causes out-of-bounds write during V4L2 encoding","impact":"high","summary":"FFmpeg through 9.0.2 has an out-of-bounds write in the V4L2 M2M encoding path, where plane offsets are not checked against the buffer length. A crafted video with specific dimensions or padding can make memcpy() write past the driver buffer, which can corrupt memory.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["ffmpeg","linux","v4l2","video-encoding"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"memory corruption while encoding attacker-supplied video","analyst_note":"Confirm the fixed FFmpeg version and exact affected build conditions from the linked patch at github.com and the vulncheck advisory.","how_to_check":"- Run `ffmpeg -version` and compare against the fixed release named in the sources (unknown)\n- Check whether FFmpeg is built with V4L2 M2M support, the path that calls v4l2_buffer_swframe_to_buf() in libavcodec/v4l2_buffers.c (unknown)","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-v4l2-encoding","trusted-input-only"],"who_is_affected":"The flaw is in FFmpeg's V4L2 M2M encoder path, so it matters where FFmpeg is used to encode video on Linux hardware with V4L2 drivers, especially when it processes video from untrusted sources. Systems that never encode through V4L2 or never handle untrusted video can likely skip it. unknown","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.00078,"input_tokens":4669,"output_tokens":626,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed FFmpeg version and exact affected build conditions from the linked patch at github.com and the vulncheck advisory.","search":"'-125208':15A,18A '-2026':14A,17A '9.0.2':29B,75C 'attack':104C 'bound':8A,35B,81C 'buf':89C,120C 'buffer':51B,68B,86C,102C,128C 'bufref':118C 'caus':4A,113C 'check':48B,98C 'contain':76C 'corrupt':71B 'craft':2A,54B,107C 'cumul':93C 'cve':13A,16A 'dimens':58B,110C 'driver':67B,127C 'encod':12A,26B,41B,132C 'ffmpeg':1A,19A,20B,27B,73C 'length':52B,103C 'libavcodec/v4l2_buffers.c':91C 'linux':21B 'm2m':40B,131C 'make':62B,121C 'memcpi':63B,122C 'memori':72B 'mmape':126C 'offset':45B,95C 'out-of-bound':5A,32B,78C 'pad':60B,112C 'past':65B,124C 'path':42B 'plane':44B,94C 'runtim':22B 'specif':57B 'suppli':106C 'swframe':87C 'unsign':114C 'v4l2':11A,23B,39B,85C,101C,117C,130C 'video':3A,25B,55B,108C 'video-encod':24B 'vulner':83C 'whose':109C 'wraparound':115C 'write':9A,36B,64B,82C,123C","nicknames":[],"mitigations":[],"who_affected":"FFmpeg up to 9.0.2 is affected when it encodes video through the V4L2 M2M encoders (the *_v4l2m2m encoders, typically on Linux hardware such as embedded boards with V4L2 codec drivers). Exploitation needs crafted video input with particular dimensions or padding. Systems that never use V4L2 M2M encoding, or only encode trusted input, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["ffmpeg"],"ptokens":["ffmpeg"],"labels":["ffmpeg","high","linux","runtime","v4l2","videoencoding"],"campaign_type":null,"search_a":"'-125208':15A,18A '-2026':14A,17A 'bound':8A 'caus':4A 'craft':2A 'cve':13A,16A 'encod':12A 'ffmpeg':1A,19A 'out-of-bound':5A 'v4l2':11A 'video':3A 'write':9A","search_b":"'9.0.2':29B 'bound':35B 'buffer':51B,68B 'check':48B 'corrupt':71B 'craft':54B 'dimens':58B 'driver':67B 'encod':26B,41B 'ffmpeg':20B,27B 'length':52B 'linux':21B 'm2m':40B 'make':62B 'memcpi':63B 'memori':72B 'offset':45B 'out-of-bound':32B 'pad':60B 'past':65B 'path':42B 'plane':44B 'runtim':22B 'specif':57B 'v4l2':23B,39B 'video':25B,55B 'video-encod':24B 'write':36B,64B","search_c":"'9.0.2':75C 'attack':104C 'bound':81C 'buf':89C,120C 'buffer':86C,102C,128C 'bufref':118C 'caus':113C 'check':98C 'contain':76C 'craft':107C 'cumul':93C 'dimens':110C 'driver':127C 'encod':132C 'ffmpeg':73C 'length':103C 'libavcodec/v4l2_buffers.c':91C 'm2m':131C 'make':121C 'memcpi':122C 'mmape':126C 'offset':95C 'out-of-bound':78C 'pad':112C 'past':124C 'plane':94C 'suppli':106C 'swframe':87C 'unsign':114C 'v4l2':85C,101C,117C,130C 'video':108C 'vulner':83C 'whose':109C 'wraparound':115C 'write':82C,123C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T19:16:57+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125208","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125208","severity":null,"published_at":"2026-11-09T19:16:57+00:00","modified_at":"2026-11-09T19:16:57+00:00","first_seen_at":"2026-11-09T19:28:18+00:00","fetched_at":"2026-11-09T19:28:18+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-125208:2331","url":null,"severity":null,"published_at":"2026-11-09T19:34:54+00:00","modified_at":"2026-11-09T19:34:54+00:00","first_seen_at":"2026-11-09T19:34:54+00:00","fetched_at":"2026-11-09T19:34:54+00:00","note":"Read FFmpeg commit b8f1598 (maintainer patch, adds bounds checks in new v4l2_buffer_swframe_to_single_buffer) and VulnCheck advisory (FFmpeg <= 9.0.2, no fixed release named, no exploitation or PoC stated). Fixed release unknown; settle by checking FFmpeg release tags after 9.0.2. Nothing marked verified."}],"documents":[{"id":109306,"url":"https://github.com/FFmpeg/FFmpeg/commit/b8f159858e2fd29dae4fa34d9e713bbf9bbf190e","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109307,"url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-v4l2-m2m-encoder-out-of-bounds-write-in-v4l2-buffers-c","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}