5.3Mittel
CVE-2026-125270FFmpeg through 9.0.2 Heap Out-of-Bounds Read in V4L2 M2M Encoder
Beschreibung
FFmpeg through 9.0.2 contains a heap out-of-bounds read vulnerability in v4l2_buffer_swframe_to_buf() in libavcodec/v4l2_buffers.c that mishandles frames with negative linesize. Attackers can supply bottom-up AVI or PNM/PFM files that are transcoded to a V4L2 M2M encoder, crashing the application or leaking heap memory into encoded output.
Schwachstellentyp (CWE):
CWE-125
Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.
Betroffene Produkte und Versionen
Referenzen und Patches
- https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24328 issue-tracking
- Patch Commit patch
- https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/v4l2_buffers.c#L410 technical-description
- https://github.com/FFmpeg/FFmpeg product
- VulnCheck Advisory: FFmpeg through 9.0.2 Heap Out-of-Bounds Read in V4L2 M2M Encoder third-party-advisory