---
id: "CVE-2026-125248"
page: "https://infrastack.ai/live/CVE-2026-125248"
kind: "vulnerability"
aliases: ["CVE-2026-125248"]
title: "FFmpeg: integer overflow in Vulkan FFV1 encoder enables out-of-bounds GPU writes"
severity: "high"
cvss: 7.3
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "ffmpeg", "fixed": [], "affected": ">= 9.0, <= 9.0.2", "ecosystem": "vendor"}]
ecosystems: []
tags: ["ffmpeg", "media-processing", "package", "transcoding", "vulkan"]
not_affected_if: ["default-config", "no-vulkan-encoder", "untrusted-input-absent"]
published_at: "2026-11-09T19:17:03+00:00"
first_seen_at: "2026-11-09T19:28:21+00:00"
updated_at: "2026-11-09T19:31:53+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-125248", "first_seen_at": "2026-11-09T19:28:21+00:00"}, {"source": "analyst", "url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25136", "first_seen_at": "2026-11-09T19:31:53+00:00", "cites": ["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25136"]}]
exploit_sources: []
---

# FFmpeg: integer overflow in Vulkan FFV1 encoder enables out-of-bounds GPU writes

Link for people: https://infrastack.ai/live/CVE-2026-125248 (this .md is for agents)

FFmpeg 9.0 through 9.0.2 undersizes a GPU buffer in the Vulkan FFV1 encoder when handling large float images or videos. An attacker who supplies a crafted GBRPF32 or GBRAPF32 file can cause out-of-bounds GPU memory writes, leading to crashes or memory corruption.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:ffmpeg affected >= 9.0, <= 9.0.2 fixed no fixed version listed

## How to check

- Run ffmpeg -version; 9.0 through 9.0.2 is in range.
- Run ffmpeg -encoders and look for ffv1_vulkan; if absent, the vulnerable encoder is not built in.
- Check pipelines for -c:v ffv1_vulkan with GBRPF32/GBRAPF32 (float RGB) input from untrusted sources.

## Fix

No released fix found. Fix proposed in FFmpeg PR #25136 (open, not merged, milestone 9.1): rejects frames whose float remap data exceeds 4 GiB. Until a release ships, avoid ffv1_vulkan on untrusted input.

## Timeline

- 2026-11-09T19:28:21+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-125248
- 2026-11-09T19:31:53+00:00 analyst https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25136 — Primary: vulncheck advisory (third-party) + FFmpeg PR 25136 (open, unmerged, 9.1 milestone) which fixes the FFV1 Vulkan remap overflow (>4 GiB). No released fixed version; no FFmpeg advisory found. Exa out of credits so no social search. Nothing verified.

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/ffmpeg-9.0-through-9.0.2-integer-overflow-via-ffv1-vulkan-encoder-remap-buffer
- [fix] FFmpeg PR 25136: libavcodec fixes (HEVC/AV1 hwaccel tile arrays, Vulkan) - open https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25136

## From the sources

FFmpeg 9.0 through 9.0.2 contains an integer overflow vulnerability in libavcodec/ffv1enc_vulkan.c that undersizes the float remap GPU buffer for large frames. Attackers can supply large GBRPF32 or GBRAPF32 images or videos that, when transcoded to FFV1 with the Vulkan encoder, trigger out-of-bounds GPU memory writes causing crashes or memory corruption.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_