{"id":"CVE-2026-125270","kind":"vulnerability","aliases":["CVE-2026-125270"],"related":[],"title":"FFmpeg: crafted AVI or PNM file leaks heap memory during V4L2 transcoding","description":"FFmpeg through 9.0.2 contains a heap out-of-bounds read vulnerability in v4l2_buffer_swframe_to_buf() in libavcodec/v4l2_buffers.c that mishandles frames with negative linesize. Attackers can supply bottom-up AVI or PNM/PFM files that are transcoded to a V4L2 M2M encoder, crashing the application or leaking heap memory into encoded output.","summary":"FFmpeg through 9.0.2 reads past a heap buffer in v4l2_buffer_swframe_to_buf() when a frame has a negative linesize. An attacker who supplies a bottom-up AVI or PNM/PFM file can crash the application or leak heap memory into the encoded output.","severity":"medium","cvss":5.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ffmpeg","linux","media-processing","runtime","v4l2"],"not_affected_if":["software-encoders-only","trusted-input-only"],"how_to_check":"- Check the installed version with `ffmpeg -version` and compare it to the ranges in the NVD record.\n- Look for V4L2 M2M encoders in use, such as `h264_v4l2m2m` or `hevc_v4l2m2m`, in scripts or services that transcode untrusted files.","fix":null,"status":"open","published_at":"2026-11-09T20:18:13+00:00","first_seen_at":"2026-11-09T20:48:14+00:00","triaged_at":"2026-11-09T20:49:52+00:00","updated_at":"2026-11-09T20:49:52+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-09T20:49:52Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"FFmpeg: crafted AVI or PNM file leaks heap memory during V4L2 transcoding","impact":"medium","summary":"FFmpeg through 9.0.2 reads past a heap buffer in v4l2_buffer_swframe_to_buf() when a frame has a negative linesize. An attacker who supplies a bottom-up AVI or PNM/PFM file can crash the application or leak heap memory into the encoded output.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["ffmpeg","v4l2","linux","media-processing"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Process crashes or heap memory leaks into encoded output","analyst_note":"Confirm fixed FFmpeg version and exact trigger conditions from the Patch link on github.com and the VulnCheck advisory.","how_to_check":"- Check the installed version with `ffmpeg -version` and compare it to the ranges in the NVD record.\n- Look for V4L2 M2M encoders in use, such as `h264_v4l2m2m` or `hevc_v4l2m2m`, in scripts or services that transcode untrusted files.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["software-encoders-only","trusted-input-only"],"who_is_affected":"Systems that run FFmpeg and transcode files from untrusted sources to a V4L2 M2M hardware encoder, typically embedded or Linux media boards. Deployments that only process trusted media or use software encoders are not shown to be exposed by these sources. unknown whether the sources list fixed versions.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000774,"input_tokens":4648,"output_tokens":619,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125270':15A,18A '-2026':14A,17A '9.0.2':28B,73C 'applic':62B,117C 'attack':48B,97C 'avi':3A,55B,103C 'bottom':53B,101C 'bottom-up':52B,100C 'bound':80C 'buf':39B,88C 'buffer':33B,36B,85C 'contain':74C 'craft':2A 'crash':60B,115C 'cve':13A,16A 'encod':69B,114C,123C 'ffmpeg':1A,19B,26B,71C 'file':6A,58B,106C 'frame':42B,93C 'heap':8A,32B,65B,76C,120C 'leak':7A,64B,119C 'libavcodec/v4l2_buffers.c':90C 'lines':46B,96C 'linux':20B 'm2m':113C 'media':22B 'media-process':21B 'memori':9A,66B,121C 'mishandl':92C 'negat':45B,95C 'out-of-bound':77C 'output':70B,124C 'past':30B 'pnm':5A 'pnm/pfm':57B,105C 'process':23B 'read':29B,81C 'runtim':24B 'suppli':50B,99C 'swframe':37B,86C 'transcod':12A,109C 'v4l2':11A,25B,35B,84C,112C 'vulner':82C","nicknames":[],"mitigations":[],"who_affected":"Systems that run FFmpeg and transcode files from untrusted sources to a V4L2 M2M hardware encoder, typically embedded or Linux media boards. Deployments that only process trusted media or use software encoders are not shown to be exposed by these sources. unknown whether the sources list fixed versions.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ffmpeg","linux","mediaprocessing","medium","runtime","v4l2"],"campaign_type":null,"search_a":"'-125270':15A,18A '-2026':14A,17A 'avi':3A 'craft':2A 'cve':13A,16A 'ffmpeg':1A 'file':6A 'heap':8A 'leak':7A 'memori':9A 'pnm':5A 'transcod':12A 'v4l2':11A","search_b":"'9.0.2':28B 'applic':62B 'attack':48B 'avi':55B 'bottom':53B 'bottom-up':52B 'buf':39B 'buffer':33B,36B 'crash':60B 'encod':69B 'ffmpeg':19B,26B 'file':58B 'frame':42B 'heap':32B,65B 'leak':64B 'lines':46B 'linux':20B 'media':22B 'media-process':21B 'memori':66B 'negat':45B 'output':70B 'past':30B 'pnm/pfm':57B 'process':23B 'read':29B 'runtim':24B 'suppli':50B 'swframe':37B 'v4l2':25B,35B","search_c":"'9.0.2':73C 'applic':117C 'attack':97C 'avi':103C 'bottom':101C 'bottom-up':100C 'bound':80C 'buf':88C 'buffer':85C 'contain':74C 'crash':115C 'encod':114C,123C 'ffmpeg':71C 'file':106C 'frame':93C 'heap':76C,120C 'leak':119C 'libavcodec/v4l2_buffers.c':90C 'lines':96C 'm2m':113C 'memori':121C 'mishandl':92C 'negat':95C 'out-of-bound':77C 'output':124C 'pnm/pfm':105C 'read':81C 'suppli':99C 'swframe':86C 'transcod':109C 'v4l2':84C,112C 'vulner':82C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T20:18:13+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125270","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125270","severity":null,"published_at":"2026-11-09T20:18:13+00:00","modified_at":"2026-11-09T20:18:13+00:00","first_seen_at":"2026-11-09T20:48:14+00:00","fetched_at":"2026-11-09T20:48:14+00:00","note":null}],"documents":[{"id":109306,"url":"https://github.com/FFmpeg/FFmpeg/commit/b8f159858e2fd29dae4fa34d9e713bbf9bbf190e","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109757,"url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-heap-out-of-bounds-read-in-v4l2-m2m-encoder","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}