FFMPEG · CVE-2026-125248 · Package
NO FIX YET · SEE WHAT TO DO
FFmpeg 9.0 through 9.0.2 undersizes a GPU buffer in the Vulkan FFV1 encoder when handling large float images or videos. An attacker who supplies a crafted GBRPF32 or GBRAPF32 file can cause out-of-bounds GPU memory writes, leading to crashes or memory corruption.
first public Nov 9, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Only builds of FFmpeg 9.0 through 9.0.2 that transcode to FFV1 with the Vulkan encoder on large GBRPF32 or GBRAPF32 inputs are exposed. Systems that only use other codecs, CPU encoders, or do not process untrusted media can skip it. The sources do not state a fixed version.
Not affected if default-config, no-vulkan-encoder, untrusted-input-absent
Who cares ffmpeg, media-processing, transcoding, vulkan
FFmpeg 9.0 through 9.0.2 contains an integer overflow vulnerability in libavcodec/ffv1enc_vulkan.c that undersizes the float remap GPU buffer for large frames. Attackers can supply large GBRPF32 or GBRAPF32 images or videos that, when transcoded to FFV1 with the Vulkan encoder, trigger out-of-bounds GPU memory writes causing crashes or memory corruption.
This page as .md · .json · CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.