FFmpeg 9.0 through 9.0.2 Integer Overflow via FFV1 Vulkan Encoder Remap Buffer
Only FFmpeg 9.0 through 9.0.2 is in range, and only when transcoding large GBRPF32 or GBRAPF32 input to FFV1 with the Vulkan encoder. CVSS rates it High (7.3). No fixed release is listed in the checked facts.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Exploited
- No known exploitation
- Fix
- No fix listed
- Who is exposed
- Specific setups only
Do first: Check whether your setup matches what the bug needs. FFmpeg versions 9.0 through 9.0.2 Transcoding to FFV1 with the Vulkan encoder Input is a large GBRPF32 or GBRAPF32 image or video Frame is large enough that the float remap GPU buffer is undersized
- Last modified
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 17/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
FFmpeg versions 9.0 through 9.0.2 contain an integer overflow in the FFV1 Vulkan encoder that can undersize a GPU buffer, letting an attacker cause crashes or memory corruption. The attack is local, requires no login, and needs a user to transcode a crafted large GBRPF32 or GBRAPF32 image or video to FFV1 with the Vulkan encoder.
Read the original description
FFmpeg 9.0 through 9.0.2 contains an integer overflow vulnerability in libavcodec/ffv1enc_vulkan.c that undersizes the float remap GPU buffer for large frames. Attackers can supply large GBRPF32 or GBRAPF32 images or videos that, when transcoded to FFV1 with the Vulkan encoder, trigger out-of-bounds GPU memory writes causing crashes or memory corruption.
cve.now Index
- Exploitation?/40Unknown. No CISA SSVC exploitation rating yet
- Exposure5/25Specific setups only
- Reach?/20Unknown. No tracked technology or package matched
- Severity7.3/10CVSS 7.3
- No patch5/5No patch listed yet
What would change the score
- Would score about 67 if added to CISA KEV
- Would score about 62 if CISA's SSVC rates exploitation active
- Would score about 27 if CISA's SSVC rates it automatable
What to do
Check whether your setup matches what the bug needs.
FFmpeg versions 9.0 through 9.0.2 Transcoding to FFV1 with the Vulkan encoder Input is a large GBRPF32 or GBRAPF32 image or video Frame is large enough that the float remap GPU buffer is undersizedWorkaround: Until a fix is available, avoid transcoding large GBRPF32 or GBRAPF32 content to FFV1 with the Vulkan encoder. Use a different encoder for that content.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- FFmpeg FFmpeg
From 9.0 · through 9.0.2
Evidence 4
- Report
- Repository
- Repository
- Link
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-125248
Is CVE-2026-125248 being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
What does this mean?
For large frames, the GPU buffer used to remap float data for the FFV1 Vulkan encoder is too small. Writes then go past its end, which can crash FFmpeg or corrupt GPU memory.Source: vulncheck.com
Which versions are affected by CVE-2026-125248?
FFmpeg: from 9.0 through 9.0.2.Source: cve.now feed data
Am I affected, and how do I check?
FFmpeg 9.0 through 9.0.2 is in the affected range. The setup is transcoding to FFV1 with the Vulkan encoder, using GBRPF32 or GBRAPF32 input large enough to undersize the buffer. To check, run ffmpeg -version for the release and look at the encoder used in the command.Source: vulncheck.com
How do I fix CVE-2026-125248?
The checked facts do not name a fixed release, so no upgrade target can be given from them. Check the FFmpeg project's advisory or release notes for a version that includes the fix.Source: vulncheck.com
What if there's no patch?
Until a fix is available, avoid transcoding large GBRPF32 or GBRAPF32 content to FFV1 with the Vulkan encoder. Use a different encoder for that content.Source: vulncheck.com