EUVD-2026-120220

FFmpeg through 9.0.2 contains a heap out-of-bounds read vulnerability in v4l2bufferswframetobuf in libavcodec/v4l2buffers.c that mishandles frames with negative linesize. Attackers can supply bottom-up AVI or PNM/PFM files that are transcoded to a V4L2 M2M encoder, crashing the application or...

EUVD-2026-120297

FFmpeg through 9.0.2 contains an out-of-bounds write vulnerability in v4l2bufferswframetobuf in libavcodec/v4l2buffers.c because cumulative plane offsets are not checked against the V4L2 buffer length. Attackers can supply crafted video whose dimensions or padding cause unsigned wraparound in...

EUVD-2026-120280

FFmpeg through 9.0.2 contains a reference count leak in libavcodec/v4l2buffers.c that allows attackers to deadlock the V4L2 mem2mem decoder on multi-plane capture formats. Attackers can supply crafted H.264, HEVC, or VP9 streams with resolution changes, making ffv4l2m2mcodecreinit wait forever an...

CVE-2026-125270

FFmpeg versions through 9.0.2 are susceptible to a heap out-of-bounds read vulnerability within the v4l2_buffer_swframe_to_buf() function in libavcodec/v4l2_buffers.c. The root cause is the improper handling of frames with negative linesize . An attacker can exploit this by providing specially cr...

CVE-2026-125191

FFmpeg versions through 9.0.2 are affected by a reference count leak located in libavcodec/v4l2_buffers.c. This vulnerability allows an attacker to supply crafted H.264, HEVC, or VP9 streams featuring resolution changes on multi-plane capture formats. This causes the ff_v4l2_m2m_codec_reinit() fu...