CVE Alert: CVE-2026-125208 – FFmpeg

FFmpeg through 9.0.2 contains an out-of-bounds write vulnerability in v4l2_buffer_swframe_to_buf() in libavcodec/v4l2_buffers.c because cumulative plane offsets are not checked against the V4L2 buffer length. Attackers can supply crafted video whose dimensions or padding cause unsigned wraparound in v4l2_bufref_to_buf(), making memcpy() write past the mmaped driver buffer during V4L2 M2M encoding.

**Risk verdict:** High-impact memory corruption risk; prioritise remediation where local video-processing workflows use the vulnerable hardware-encoding path, but the available data does not establish active exploitation.

**Why this matters:** A successful write beyond the intended buffer could crash a processing service or corrupt its memory, with possible compromise of that process. Realistic attacker goals include disrupting media pipelines or gaining control of a process that handles sensitive files; exploitation is not guaranteed by the supplied evidence.

**Most likely attack path:** An attacker needs a crafted video to reach a host that processes it through the relevant V4L2 M2M encoder; the local vector and present attack requirement limit exposure to suitable systems and workflows. No privileges are required, but user interaction is needed to trigger processing and attack complexity is high. Scope is unchanged, so the stated impacts are confined to the affected security authority; lateral movement is not indicated.

**Who is most exposed:** Linux hosts running video conversion, streaming, editing or media-ingest services with V4L2 hardware encoding enabled are the main concern. Exposure is lower where that encoder path is not used.

Identify jobs invoking V4L2 M2M encoding and record input provenance.

Alert on encoder-process crashes, restarts or unusual memory faults during media processing.

Review logs for rejected buffers, plane-size anomalies or V4L2 errors.

Check whether crafted or untrusted media is processed on affected hosts.

Mitigation and prioritisation

Apply the upstream fix promptly to exposed systems; confirm vendor backports where packages are maintained downstream.

Temporarily disable V4L2 M2M encoding or route untrusted media to a patched, isolated worker.

Restrict who can submit media and monitor queued inputs.

KEV, SSVC, PoC and EPSS indicators were not provided; obtain them to refine urgency.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.